GDPR
PaperOffice meets the GDPR requirements for processors — DPA (Art. 28) and TOMs (Art. 32) from the generator, processing in the EU.
- Data processing in the EU
- Right to deletion
- Transparent processing
Security & Compliance
Control that can be verified.
DPA, TOMs and ISO/IEC 27001 certificate — documented, not merely claimed.
Trusted by leading companies worldwide
OEM PARTNERSHIP
Hardware giants choose PaperOffice exclusively.
Sole official DMS partner for QNAP: Classic app, AI BYOS.
MoreISO/IEC 27001
CERTIFIED
SOC 2 Type 2
IN PREPARATION
Sole official DMS partner for ASUSTOR: Classic app, AI BYOS.
MoreProof
In the DataCenter. In the app.
Processing on own hardware in the EU Datacenter Spain. The generator produces the DPA and the TOMs — from company data, as a PDF.
100% EUNo public cloudNo sub-processors
Standards & evidence EU Datacenter Spain
Own hardware. No public cloud. No hyperscalers.
Generator in the app
DPA and TOMs are produced from company data, as a PDF.
Cloudflare Inc.
Network protection: DDoS mitigation, WAF and CDN. No access to documents.
Further documentation
Whitepaper, penetration-test report and the ISO/IEC 27001 certificate on request from the Enterprise plan.
Standards & evidence
Recognised security standards. Audit-ready.
Documented standards: GDPR requirements for processors met, ISO/IEC 27001 certified; SOC 2 Type II in preparation.
ISO/IEC 27001 (certified) ISO/IEC 27001 certified (certificate available under NDA); SOC 2 Type II in preparation.
International standard for Information Security Management
- ISO/IEC 27001 ISMS (certified)
- Annual audits
- Continuous improvement
SOC 2 Type II (in preparation) ISO/IEC 27001 certified (certificate available under NDA); SOC 2 Type II in preparation.
AICPA Service Organization Control for Trust Services Criteria
- Security Controls
- Availability
- Confidentiality
HIPAA
US standard for health data — PaperOffice meets all technical safeguard requirements of the HIPAA Security Rule.
- Access control, MFA and audit trails
- Encryption in transit and at rest
- BAA on request (separate addendum)
Card payments via Stripe
Card payments run through Stripe Checkout. Card details are entered at Stripe and do not reach PaperOffice servers.
- Stripe: PCI DSS Level 1 service provider
- Payment page hosted by Stripe
- No card numbers on PaperOffice servers
GoBD
Technical building blocks for record-keeping under the GoBD (German bookkeeping rules)
- Immutable versions (WORM)
- Checksums and completeness
- Complete audit log
ISO/IEC 27001 certified (certificate available under NDA); SOC 2 Type II in preparation.
Encryption
AES-256 Encryption
Every document is stored encrypted with AES-256 and transmitted over TLS 1.3.
At Rest
All stored data fully encrypted
In Transit
TLS 1.3 for all connections
Key Management
Keys stored outside the database — readable only by authorised services
Access control
Decryption only for authorized processing – with audit trail
Architecture
Zero Trust. No implicit trust. Every request is verified.
Every request is authenticated. Every access is logged. No exceptions.
Identity First
Multi-factor authentication, passkeys and Google sign-in; code challenge for new devices and unusual networks.
Least Privilege
Minimal permissions. Only access to what's really needed.
Continuous Verification
Permanent verification. No "trusted zones". Every session is validated.
Full Audit Trail
Complete logging of all access. Immutable audit logs.
Micro-Segmentation
Isolated network segments. Breach in one area stays isolated.
Login Monitoring
Alerts for logins from new devices, new IP addresses or VPN, proxy and data-centre networks. “No, this was not me” locks the account and ends all sessions.
Trust Center
DPA and TOMs in the app.
The generator in the app produces the DPA and the TOMs — from company data, as a PDF.
Art. 28 GDPR
DPA generator
The data processing agreement is created in the app — pre-filled with the company data, as a PDF on PaperOffice letterhead.
- Services selectable individually
- Bundled with the TOMs in the compliance package
- History of all generated versions
Art. 32 GDPR
TOM generator
Technical and organisational measures for exactly the services used in the account.
- Measures catalogue per service
- Preview before download
- PDF in the compliance package together with the DPA
Real time
Security Center
All devices and sessions of the account at a glance — who accesses what, when and from where.
- Device dashboard with live status
- Location map of active sessions
- Lock or remove sessions
Access control
Geo-Fencing
Per device, the countries from which access is permitted are defined. Regions not approved are blocked.
- Country approval per device
- Blocking of non-approved regions
- Managed in the Security Center
Transparency
No sub-processors. Maximum control.
PaperOffice runs its own EU infrastructure. Against DDoS attacks and bots, PaperOffice uses Cloudflare Enterprise as network protection — with no access to documents.
Network protection
Cloudflare Inc.
DDoS Protection & CDN
- DDoS mitigation, WAF and bot protection
- No access to document contents
- Enterprise plan with priority support
- Pure traffic routing – no data storage
Core infrastructure: 100% own systems
Databases, storage, AI models and backup systems run on our own hardware in the EU Datacenter Spain.
- No US hyperscaler cloud services
- No US CLOUD Act – no access by US authorities
- Own AI infrastructure for all functions
- No data transfer to third countries
Further documentation
Whitepaper, penetration-test report and the ISO/IEC 27001 certificate are available on request from the Enterprise plan.
In the app
- Data processing agreement (DPA) Under Art. 28 GDPR — generated from the company data.
- TOM documentation Technical and organisational measures under Art. 32 GDPR.
- Compliance package DPA and TOMs as one PDF, with a history of all versions.
On request from the Enterprise plan
- Security whitepaper Architecture, encryption and security processes at a glance.
- Penetration test report Summary of the most recent independent assessment — under NDA.
- Certificate & audit status ISO/IEC 27001 certificate on request under NDA; SOC 2 Type II in preparation.