How papyro holds a company's documents.

1Where the data lives

All data is stored on servers in Nuremberg, Germany, run by Hetzner Online GmbH (hosting, database and encrypted backups), in ISO 27001-certified data centres. No personal data leaves the European Economic Area.

The AI step runs on the company's own AI account, under the company's own contract with its provider; that account decides where the text is processed (clause 5).

Signing in needs no git host: a person signs in with Microsoft Entra, or with a code emailed to the work address. A company may connect its git host (GitHub, gitlab.com or its own GitLab) as a mirror; the project's repository lives on papyro's servers either way.

2What papyro holds

Each kind of data is held for one reason, stated beside it.

3How it is protected

• In transit. TLS 1.2 or later on every connection, with HSTS.
• Secrets at rest. AI credentials and git host credentials are encrypted with Fernet (AES-128), under keys derived per user and per organisation with HKDF.
• Access. Access is granted through organisation membership and role, and is never keyed on an email address.
• Backups. Encrypted with AES-256 before they leave the host, stored on a target in Germany, kept for a limited period, with a restore procedure that is documented and tested.
• The security log. Every sign-in, sign-out and account deletion is written to the security log. Sign-in endpoints are rate-limited against brute force.
• Sessions. Session cookies are httponly and samesite=lax, and travel over HTTPS only. A session ends after eight hours without use, and after 24 hours in any case.

4Who can read the documents: an honest answer

papyro does not over-claim, so here is the precise access model, in two parts.

The service at papyro.space. The documents are held on papyro's servers as a git repository and its working copies, so that the service can build the wiki, render the PDF, run the assistant and show diffs. They are access-controlled, encrypted in transit and encrypted in every backup; the credentials beside them are encrypted at rest. This is encryption where papyro holds the keys, not end-to-end encryption. That means:

• Backups are unreadable to outsiders. They are encrypted before they leave the host, and the key is kept apart from the backup store.
• papyro can read the documents, by necessity. papyro's authorised personnel can technically read them, because the service must read them in plain text to work. papyro is bound by a GDPR Article 28 data processing agreement to do so only to operate the service and on the company's instructions, and never to use or disclose the content otherwise.

This is the usual trust model for a documentation service: the company trusts papyro, the provider, backed by encryption, access control, the security log and a contract, not by cryptography that keeps papyro out.

Enterprise, on the company's own ground. papyro runs on the company's own infrastructure, under the company's own control, and the documents never reach papyro's servers or backups. It is the fit for the most IP-sensitive programmes; write to carlos@papyro.space to ask about it.

5The AI step

LISE, the assistant, works on a bring-your-own-account basis. When she is used, the relevant text from the document goes to the AI provider the company has chosen, with the company's own credential and under the company's own agreement with that provider. This can be a direct API key (Anthropic, OpenAI, Mistral, Google) or the company's own AWS Bedrock or Google Vertex account, which lets the model run in an EU region of the company's choosing under its own cloud contract.

papyro routes no AI request through an account of its own and retains none of the content. The AI provider is the company's processor, not papyro's.

LISE proposes; the author accepts, edits or dismisses each proposal, and her answers show the standards they are grounded in. papyro never uses the content of documents to train AI models.

6Your rights

• Export. Download all personal data held about you as machine-readable JSON, at any time, under Settings › Export my data.
• Erasure. Delete the account and everything attached to it, at once, under Settings › Delete account.
• Removing a project removes it from papyro's servers at once: the clone of the repository, every member's working copy, the stored git credential and the search index. A mirror at the company's git host, if one is connected, is untouched.
• Storage limitation. Accounts with no sign-in for 12 months are deleted automatically.
• Breach notice. If a personal-data breach happens, papyro tells the companies affected without undue delay, and within 72 hours of becoming aware of it (GDPR Article 33).

To exercise any of these, write to carlos@papyro.space. papyro answers within 30 days. The privacy policy sets out every right in full.

7Where papyro stands

Hetzner's data centres are certified to ISO/IEC 27001; papyro is building toward its own certification. Its control set is mapped to Annex A in a statement of applicability.

papyro signs a GDPR Article 28 data processing agreement with the company, as its processor; the company remains the controller of its project data.

Still pending: a third-party penetration test, and the certification audit itself. Current status and timelines are shared under NDA.

8Sub-processors

A sub-processor is a third party papyro engages that may process personal data on its behalf. papyro keeps the list short.

The sign-in code travels through a transactional mail service, which sees the work address and the code.

Not sub-processors. These parties may receive data, but not as papyro's sub-processors:

• The company's AI provider, on the company's own key or cloud account and under its own contract. The provider is the company's processor (clause 5).
• Microsoft, as identity provider. The company's own tenant signs its people in and reports a name, an address and an account identifier. papyro keeps no token from it.
• The company's git host (GitHub or GitLab), only as a mirror an owner connects, under the company's own agreement with that host.

Changes. Companies under a signed data processing agreement are told at least 30 days before a new sub-processor with access to personal data starts, and may object on reasonable data-protection grounds.