Scan, Sign & AI Chat
Mobile App
The mobile app pairs with your account via QR code and brings scanner, signature, chat and documents to your phone.
Security & trust
Security & trust.
Certified to ISO/IEC 27001:2022, verified in Claude and ChatGPT
and the sole official DMS partner of QNAP and ASUSTOR.
ISO/IEC 27001:2022
In scope:
- Web, desktop & mobile apps
- REST API & MCP interfaces
- AI, document processing & workflows
- Datacenter & offsite backup
- Support, consulting & integration
- BYOS interfaces
Verified
Claude
Verified MCP connector.
Learn more Verified
ChatGPT
Verified MCP plugin.
Learn more
Since 2019
QNAP
Sole official DMS partner.
Learn more
Since 2024
ASUSTOR
Sole official DMS partner.
Learn more- EU datacenterLocations in the EU
- Access control & MFARoles and tenant isolation
- Audit trailFully traceable
- API + MCPOpen integration
- BYOSYour AI. Your data. Your control.
Certified ISMS
ISO/IEC 27001:2022.
Certified ISMS for the PaperOffice AI platform – audited by TNV, accredited by UAF.
Within the certified scope
Web, desktop & mobile apps
All PaperOffice AI interfaces.
CertifiedREST API
Programmatic access for your own systems.
CertifiedMCP interfaces
Connection to Claude, ChatGPT and other AI assistants.
CertifiedBYOS
Connection to your own storage.
CertifiedAI & document processing
OCR, extraction and classification.
CertifiedWorkflows & integration
Automation and connectors.
CertifiedSupport & consulting
Help with setup and operation.
CertifiedIT infrastructure & datacenter
Servers, network and operations in the EU datacenter.
CertifiedOffsite backup
Backups at a separate location.
CertifiedRemote staff & contractors
Security processes for everyone involved.
CertifiedAnnex A: all 93 controls applied
37
Organisational
Policies, roles, suppliers, incident and continuity management, compliance.
Applied8
People
Screening, training, confidentiality, remote work, reporting.
Applied14
Physical
Access, protection of premises and equipment, utilities, disposal.
Applied34
Technological
Access, cryptography, logging, backup, secure development, networks.
AppliedDatacenter & infrastructure
Our own hardware in the EU.
Databases, storage, AI models and backups run on our own hardware in the EU datacenter in Spain. No public cloud, no US hyperscalers.
EU datacenter
Our own systems in the EU, no data transfer to third countries.
Offsite backup
Separate location for backups, within the certified scope.
Encryption in transit
All connections are encrypted with TLS 1.2 or higher.
High availability
Database cluster with synchronous replication across several nodes.
Network protection
DDoS defence, WAF and bot protection via Cloudflare Enterprise, without access to documents.
Access & control
Every access checked and logged.
Zero Trust: every request is authenticated, every access is logged.
MFA & passkeys
Multi-factor authentication, passkeys and sign-in with Google. Code check for new devices and unusual networks.
Roles & tenant isolation
Least privilege. Every workspace is isolated from the others.
Audit trail
Complete, immutable logs of every access.
Security Center & geo-fencing
Devices and sessions at a glance, country approval per device. “No, that wasn't me” locks the account.
BYOS
Documents on your own storage, for example on a QNAP or ASUSTOR NAS. Your AI. Your data. Your control.
AI & data
AI on our own infrastructure.
All PaperOffice AI features run on our own hardware in the EU datacenter.
Own AI infrastructure
AI models on our own servers in the EU, no US cloud services.
No third countries
No data transfer to third countries, no access under the US CLOUD Act.
Claude & ChatGPT, your choice
If you use PaperOffice via Claude or ChatGPT, the connector only accesses data after you sign in. You decide what goes to the assistant.
Standards & evidence
Recognised security standards.
EU
GDPR
PaperOffice meets the GDPR requirements for processors — DPA (Art. 28) and TOMs (Art. 32) from the generator, processing in the EU.
- Data processing in the EU
- Right to deletion
- Transparent processing
DE
GoBD
Technical building blocks for record-keeping under the GoBD (German bookkeeping rules)
- Immutable versions (WORM)
- Checksums and completeness
- Complete audit log
Payments
Card payments via Stripe
Card payments run through Stripe Checkout. Card details are entered at Stripe and do not reach PaperOffice servers.
- Stripe: PCI DSS Level 1 service provider
- Payment page hosted by Stripe
- No card numbers on PaperOffice servers
Art. 28 GDPR
DPA generator
The data processing agreement is created in the app — pre-filled with the company data, as a PDF on PaperOffice letterhead.
- Services selectable individually
- Bundled with the TOMs in the compliance package
- History of all generated versions
Art. 32 GDPR
TOM generator
Technical and organisational measures for exactly the services used in the account.
- Measures catalogue per service
- Preview before download
- PDF in the compliance package together with the DPA
Responsible disclosure
Found a vulnerability?
Report it to us
Write to support@paperoffice.ai with a description, the affected address and steps to reproduce. We reply in English or German.
Data protection and processing: Privacy policy · You create the DPA and TOMs with the generator in the app.
