Paperform

Paperform is SOC 2 Type II compliant. On SOC2C this listing is Listed.

According to Paperform's public trust center, Paperform is GDPR compliant. On SOC2C this listing is Listed.

Paperform is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.

Yes. Paperform's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Paperform hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Our primary servers are based in the USA and hosted by AWS. We offer other regions, including EU and AU, hosting options upon request, so please talk to us at support@paperform.co if you would like to have your data stored in a specific region. This includes AI Data Residency options that keeps AI inference inside a defined geographic boundary.

Paperform follows industry best standards to keep your information safe. We are SOC 2 Type II and GDPR compliant. Our primary servers are based in the USA and hosted by AWS. We offer other regions and hosting options upon request, so please talk to us at support@paperform.co if you would like to have your data stored in a specific region. ### Data Security Measures Form submissions are secured using TLS 1.2 SSL from the submitters browser through to our servers. SSL (Secure Sockets Layer) is the standard security technology for establishing an encrypted link between a web server and a browser. This link ensures that all data passed between the web server and browsers remain private and integral. SSL is an industry standard and is used by millions of websites in the protection of their online transactions with their customers. Encrypted at Rest - Forms and submissions are stored in a database that is encrypted at rest. Employee Access Restriction - The only people who have access to your data is yourself, and a select few of the Paperform technical team required to maintain systems and provide advanced technical customer support. Regularly maintained systems - We regularly update the technology and systems we use to stay on top of the latest vulnerabilities. Ability to turn off storage on Paperform - If you require data be stored solely in your own systems, you can turn off storage on Paperform on a per-form basis. Note that submissions are held temporarily (generally under 1 minute) if there are emails, webhooks or Zapier integrations in place. We treat uploads separately to other submission data for "turn storage off", and delete these on request. This is because the images have to be hosted to be viewed/retrieved. We offer BYOS3 Bucket (store your own), which supports files being sent directly to your servers, and so avoid upload storage on our servers. If your forms generate custom PDFs these are handled similarly to file uploads which can be stored in your…

Yes, Paperform Pty. Ltd. has completed our System and Organization Controls (SOC) 2 Type I Audit Industry-Standard Accreditation. We are also GDPR compliant, and provide penetration testing attestation. That means that anyone using these Paperform Platform Products (Paperform form-builder, Papersign eSignature tool, Agency+) can rest assured knowing that our software and services are protected by one of the highest recognized standards of information security compliance in the world. However note that Dubble and Stepper, which are owned by Paperform Pty. Ltd. are not currently certified GDPR or SOC 2 compliant. We obtained our audited SOC 2 Report by partnering with Johanson Group who respectively review our internal controls including policies, procedures, and infrastructure regarding data security, firewall configurations, change management, logical access, backup management, business continuity and disaster recovery, security incident response, and other critical areas of our business. We’re proud to confidently say we go above and beyond the minimum requirements for SOC 2 by integrating our critical infrastructure to monitor compliance to the SOC 2 framework 24/7/354, not just during the audit window. As we look to 2026 and beyond, and grow our newest products, we plan on having more official compliance certifications under our belt. Our controls can be viewed in this Trust Centre. *To access our SOC 2 Type II Report, please make the request in the 'Resources' section of this Trust Centre* To ask us more about our Business or Enterprise offerings for Paperform, check out our pricing here https://paperform.co/pricing/, or reach out to our Sales Team at support@paperform.co

The Paperform Platform is GDPR compliant. Read on to find out more. ### I’m a Paperform customer, how does Paperform relate to me in terms of GDPR? For information you provide directly to us as a customer (e.g. your name and email address), Paperform acts as Controller. For information captured using Paperform's services, Paperform acts as a Processor. It is important that we all comply with the GDPR when transferring personal data. ### Must data be stored in the EU to be GDPR compliant? No, this is a common misconception. There is no requirement for data to be stored in the EU, as long as it is adequately protected in line with the requirements of the GDPR. Our default servers are located in North America, however we offer other regions such as the EU upon request. Reach out to support@paperform.co to talk to someone about local servers for your region. ### What has Paperform done in regards to GDPR? We have taken several important steps: 1. We have prepared a Data Processing Agreement that clearly sets out the roles and obligations of customers and Paperform when handling personal data that is captured by the GDPR. 2. We’ve built new features internally to ensure that we can meet our GDPR obligations, including permanently deleting customer data on request. 3. We’ve updated our Privacy Policy and Terms and Conditions (DPA can be found linked in the T&Cs) to ensure they align with our obligations. 4. We’ve appointed an EU Representative for Paperform. See the Privacy Policy for more information. 5. We’ve reviewed our vendors, discussed their GDPR plans, and arranged similar GDPR-ready data processing agreements with them. 6. We’ve reviewed and implemented new internal security measures to ensure your data is safe. 7. We have implemented policies and systems that require us to continually monitor, assess and improve our data privacy and security practices. 8. Please note that Dubble, which is not part of the Paperform Platform but is owned by Paperform Pty. Ltd. is…

Paperform's DPA is built into the standard Paperform Terms. You are not required by Paperform to sign this agreement, but you can should your business require it. You can access the DPA via this form: https://paperform.co/data-processing-agreement/