Where your data is stored
Your documents are stored and backed up in Spain, in PaperOffice's own data center in Navarra. PaperOffice runs its own servers there and uses no public cloud for this. You cannot choose a different region. Your contracting party is PaperOffice Enterprise Operations, S.L.U., based in Pamplona, Navarra; Spanish law applies.
You can connect your own storage under Storage Mounts (BYOS). The files then stay encrypted on your storage. PaperOffice still keeps the index, metadata and AI results in its own data center. Audit-proof archiving (WORM) is not available on your own storage, because the file remains deletable there.
As an owner or administrator, open the Trust Center in the app to create the compliance package with the data processing agreement and the technical and organizational measures. Details on how personal data is processed are in the privacy policy.
Virus scan on upload and email intake
PaperOffice AI checks every file for viruses and threats before it is stored. You do not need to set anything up.
- During the upload, you see that the file is being checked. A clean file is stored as usual.
- An infected file is rejected and not stored. There is no virus quarantine from which you could restore it. Check the file with your own antivirus and ask the sender for a clean copy.
- If the check is briefly unavailable, the file is not stored either, for safety reasons. Try again shortly.
- A password-protected PDF that is unlocked during upload is checked again after unlocking.
- Email attachments and files you upload to a knowledge base are checked the same way.
The virus scan is not the security quarantine of the AI-DMS Ultra audit, which applies to stored documents with a high fraud risk.
Is an incoming email genuine?
PaperOffice AI does not automatically check incoming emails for authenticity, for example via SPF, DKIM or DMARC, and gives no “genuine” or “fake” verdict. You do have tools to check for yourself:
- Select a document from the email intake and choose Actions → Email → Show email details to see header, sender and recipients.
- Use Actions → Email → Open original email to see the original message.
- If the email exists as a PDF, check it with a Trust Agent that uses the verification profile for email exports. It looks for hidden content, header manipulation and edited image-only PDFs. The Trust Agent is paid.
If in doubt, call the sender on a number you already know, especially when bank details have changed.
Audit-proof archiving: WORM and legal hold
WORM makes a document audit-proof. Its document type and retention details are then locked, and changes only happen as a new version with a required comment. WORM applies per document and cannot be undone.
- Open the document. The Overview tab shows whether it is revision-secure.
- Click Activate WORM retention. The Revisions tab opens.
- Choose when the period starts: immediately or at year end.
- Confirm the irreversible activation.
A legal hold is a deletion lock, for example during a legal case. Click Place legal hold in the document, enter a reason and confirm; use Release to lift it. A legal hold blocks deleting, moving and renaming, including all versions, regardless of the retention period, and it also works without WORM. Only owners and administrators of the organization can set or release a legal hold.
- WORM is available from the Business workspace type and not on your own storage (BYOS).
- Activating WORM is paid.
- Audit records are under Analytics AI → Audit Center.
- PaperOffice supplies versions, checksums, an access log and retention terms for rules such as the German GoBD. Whether your process as a whole is sufficient is for your tax advisor to judge, based on your process documentation.
Send documents securely by email
You send original files by email with proof of delivery. The recipient gets a secure link, PDFs are protected with a password, and every opening and download is logged.
- Open Documents, select up to 10 documents and choose Actions → Share & export → Send by email.
- Enter the recipient, the subject and a personal message.
- Under Secure access, choose whether the PDF password is sent by email or by SMS, and click Send now.
- Check the status under Actions → Share & export → Delivery status. There you open the protocol, revoke the link or resend the email.
The link is valid for 7 days, and each file can only be retrieved a limited number of times. After revoking, the link no longer works. Sending, SMS and a proof PDF of the delivery are paid. Documents in security quarantine cannot be sent.
Devices, passkeys and two-factor sign-in
The Security Center shows the devices and sessions of your account. Open it in the sidebar under Team & Security → Security Center.
- Pair a smartphone with Add mobile device.
- Lock a lost or sold smartphone right away: find it under the registered devices, open its menu and choose Lock device for all accounts. All sessions on the device end. This lock exists only for smartphones and tablets, and only the account that owns the device can trigger it.
- Invalidate only disconnects a device from your account; Remove deletes the device record permanently.
- On devices with a built-in authenticator such as Windows Hello, you set up a passkey on the same page under Windows Hello / Passkey. The card only appears if the device supports it.
- When you sign in, PaperOffice can ask for a confirmation code, for example on a new device or from an unusual network. The code is sent by email or, if a phone number for two-factor sign-in is set up for the user, by SMS. You switch on two-factor sign-in per user in Users Management; this requires active auto-refill, because sending codes is paid. An authenticator app is not available yet.
- An IP whitelist exists for API keys. An IP restriction for users or groups currently has no effect.
Frequently asked questions
- Can I choose where my data is stored? No. Documents are stored in PaperOffice's own data center in Navarra, Spain. With your own storage, the files stay with you.
- Can I restore a file that the virus scan rejected? No. Infected files are not stored.
- Does PaperOffice tell me whether an email is fake? No. It gives you tools to check header, sender and email PDFs.
- Can WORM be undone? No. Use a legal hold if you only need a temporary lock.
- How long does a secure email link work? 7 days, unless you revoke it earlier.