GDPR
Full compliance with the EU General Data Protection Regulation
- Data processing in the EU
- Right to deletion
- Transparent processing
Security & Compliance
Control that can be verified.
DPA, TOMs, sub-processors and certifications — documented, not merely claimed.
Trusted by leading companies worldwide
OEM PARTNERSHIP
Hardware giants choose PaperOffice exclusively.
Proof
In the DataCenter. In the app.
Processing on own hardware in the EU Datacenter Spain. The generator produces the DPA and the TOMs — from company data, as a PDF.
100% EUNo public cloudOne sub-processor
Certifications EU Datacenter Spain
Own hardware. No public cloud. No hyperscalers.
Generator in the app
DPA and TOMs are produced from company data, as a PDF.
Cloudflare Inc.
Sole external processor: DDoS protection and CDN. No access to documents.
Further documentation
Whitepaper, penetration-test report and certificates on request from the Enterprise plan.
Certifications
Highest security standards. Audit-ready.
All relevant compliance requirements met. SOC 2 Type II and ISO 27001 are active.
ISO 27001 (active) ISO 27001 and SOC 2 Type II are active. Reports available on request under NDA.
International standard for Information Security Management
- ISO 27001 ISMS (active)
- Annual audits
- Continuous improvement
SOC 2 Type II (active) ISO 27001 and SOC 2 Type II are active. Reports available on request under NDA.
AICPA Service Organization Control for Trust Services Criteria
- Security Controls
- Availability
- Confidentiality
HIPAA
US standard for health data protection
- PHI protection
- BAA available
- Audit Trails
PCI DSS
Payment Card Industry Data Security Standard
- Secure card data
- Network segmentation
- Access controls
GoBD
German principles for proper record keeping
- Audit compliance
- Immutability
- Completeness
ISO 27001 and SOC 2 Type II are active. Reports available on request under NDA.
Encryption
AES-256 Encryption
Every document is encrypted at rest and in transit. Key management uses HSMs.
At Rest
All stored data fully encrypted
In Transit
TLS 1.3 for all connections
Key Management
HSM-based key management
Access control
Decryption only for authorized processing – with audit trail
Architecture
Zero Trust. No implicit trust. Every request is verified.
Every request is authenticated. Every access is logged. No exceptions.
Identity First
Multi-factor authentication, SSO, biometric options for every access.
Least Privilege
Minimal permissions. Only access to what's really needed.
Continuous Verification
Permanent verification. No "trusted zones". Every session is validated.
Full Audit Trail
Complete logging of all access. Immutable audit logs.
Micro-Segmentation
Isolated network segments. Breach in one area stays isolated.
AI Threat Detection
AI-based anomaly detection. Threats detected in real-time.
Trust Center
DPA and TOMs in the app.
The generator in the app produces the DPA and the TOMs — from company data, as a PDF.
Art. 28 GDPR
DPA generator
The data processing agreement is created in the app — pre-filled with the company data, as a PDF on PaperOffice letterhead.
- Services selectable individually
- Sub-processor register as an annex
- History of all generated versions
Art. 32 GDPR
TOM generator
Technical and organisational measures for exactly the services used in the account.
- Measures catalogue per service
- Preview before download
- PDF in the compliance package together with the DPA
Real time
Security Center
All devices and sessions of the account at a glance — who accesses what, when and from where.
- Device dashboard with live status
- Location map of active sessions
- Lock or remove sessions
Access control
Geo-Fencing
Per device, the countries from which access is permitted are defined. Regions not approved are blocked.
- Country approval per device
- Blocking of non-approved regions
- Managed in the Security Center
Transparency
Clearly defined sub-processors. Maximum control.
PaperOffice operates its own EU infrastructure. Only the sub-processors listed below are used externally – fully documented in the DPA sub-processor directory.
Sub-processor
Cloudflare Inc.
DDoS Protection & CDN
- EU Standard Contractual Clauses (SCC) in place
- No access to document contents
- Processes only IP addresses and HTTP headers
- Pure traffic routing – no data storage
Core infrastructure: 100% own systems
Databases, storage, AI models, email servers and backup systems run on our own hardware in the EU Datacenter Spain.
- No US hyperscaler cloud services
- No US CLOUD Act – no access by US authorities
- Own AI infrastructure for all functions
- No data transfer to third countries
Further documentation
Whitepaper, penetration-test report and certificates are available on request from the Enterprise plan.
In the app
- Data processing agreement (DPA) Under Art. 28 GDPR — generated from the company data.
- TOM documentation Technical and organisational measures under Art. 32 GDPR.
- Sub-processor register All processors with role, location and transfer basis.
On request from the Enterprise plan
- Security whitepaper Architecture, encryption and security processes at a glance.
- Penetration test report Summary of the most recent independent assessment — under NDA.
- Audit reports ISO 27001 and SOC 2 reports on request under NDA.
Security that can be verified.
DPA, TOMs and the sub-processor register are available in PaperOffice.