Paperform

Paperform's SOC 2 report is available on request. Request access through SOC2C and we coordinate the company-side NDA and delivery.

Security isn't a single yes/no, but Paperform is SOC 2 Type II compliant and holds SOC 2 Type II, GDPR. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Paperform hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@paperform.app or via a /security page (Paperform lists a security contact).

Paperform lists 24 subprocessors on its trust center, including Stripe AU, Intercom, Atlassian, Google Analytics, Mailgun. Buyers use this for fourth-party risk review.

Paperform hosts on AWS, GCP, Azure, and handles Customer personally identifiable information. Data residency details are on its trust center.

Paperform's trust center is at https://trust.paperform.app. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Our primary servers are based in the USA and hosted by AWS. We offer other regions, including EU and AU, hosting options upon request, so please talk to us at support@paperform.co if you would like to have your data stored in a specific region. This includes AI Data Residency options that keeps AI inference inside a defined geographic boundary.

Paperform follows industry best standards to keep your information safe. We are SOC 2 Type II and GDPR compliant. Our primary servers are based in the USA and hosted by AWS. We offer other regions and hosting options upon request, so please talk to us at support@paperform.co if you would like to have your data stored in a specific region. ### Data Security Measures Form submissions are secured using TLS 1.2 SSL from the submitters browser through to our servers. SSL (Secure Sockets Layer) is the standard security technology for establishing an encrypted link between a web server and a browser. This link ensures that all data passed between the web server and browsers remain private and integral. SSL is an industry standard and is used by millions of websites in the protection of their online transactions with their customers. Encrypted at Rest - Forms and submissions are stored in a database that is encrypted at rest. Employee Access Restriction - The only people who have access to your data is yourself, and a select few of the Paperform technical team required to maintain systems and provide advanced technical customer support. Regularly maintained systems - We regularly update the technology and systems we use to stay on top of the latest vulnerabilities. Ability to turn off storage on Paperform - If you require data be stored solely in your own systems, you can turn off storage on Paperform on a per-form basis. Note that submissions are held temporarily (generally under 1 minute) if there are emails, webhooks or Zapier integrations in place. We treat uploads separately to other submission data for "turn storage off", and delete these on request. This is because the images have to be hosted to be viewed/retrieved. We offer BYOS3 Bucket (store your own), which supports files being sent directly to your servers, and so avoid upload storage on our servers. If your forms generate custom PDFs these are handled similarly to file uploads which can be stored in your…

Yes, Paperform Pty. Ltd. has completed our System and Organization Controls (SOC) 2 Type I Audit Industry-Standard Accreditation. We are also GDPR compliant, and provide penetration testing attestation. That means that anyone using these Paperform Platform Products (Paperform form-builder, Papersign eSignature tool, Agency+) can rest assured knowing that our software and services are protected by one of the highest recognized standards of information security compliance in the world. However note that Dubble and Stepper, which are owned by Paperform Pty. Ltd. are not currently certified GDPR or SOC 2 compliant. We obtained our audited SOC 2 Report by partnering with Johanson Group who respectively review our internal controls including policies, procedures, and infrastructure regarding data security, firewall configurations, change management, logical access, backup management, business continuity and disaster recovery, security incident response, and other critical areas of our business. We’re proud to confidently say we go above and beyond the minimum requirements for SOC 2 by integrating our critical infrastructure to monitor compliance to the SOC 2 framework 24/7/354, not just during the audit window. As we look to 2026 and beyond, and grow our newest products, we plan on having more official compliance certifications under our belt. Our controls can be viewed in this Trust Centre. *To access our SOC 2 Type II Report, please make the request in the 'Resources' section of this Trust Centre* To ask us more about our Business or Enterprise offerings for Paperform, check out our pricing here https://paperform.co/pricing/, or reach out to our Sales Team at support@paperform.co

The Paperform Platform is GDPR compliant. Read on to find out more. ### I’m a Paperform customer, how does Paperform relate to me in terms of GDPR? For information you provide directly to us as a customer (e.g. your name and email address), Paperform acts as Controller. For information captured using Paperform's services, Paperform acts as a Processor. It is important that we all comply with the GDPR when transferring personal data. ### Must data be stored in the EU to be GDPR compliant? No, this is a common misconception. There is no requirement for data to be stored in the EU, as long as it is adequately protected in line with the requirements of the GDPR. Our default servers are located in North America, however we offer other regions such as the EU upon request. Reach out to support@paperform.co to talk to someone about local servers for your region. ### What has Paperform done in regards to GDPR? We have taken several important steps: 1. We have prepared a Data Processing Agreement that clearly sets out the roles and obligations of customers and Paperform when handling personal data that is captured by the GDPR. 2. We’ve built new features internally to ensure that we can meet our GDPR obligations, including permanently deleting customer data on request. 3. We’ve updated our Privacy Policy and Terms and Conditions (DPA can be found linked in the T&Cs) to ensure they align with our obligations. 4. We’ve appointed an EU Representative for Paperform. See the Privacy Policy for more information. 5. We’ve reviewed our vendors, discussed their GDPR plans, and arranged similar GDPR-ready data processing agreements with them. 6. We’ve reviewed and implemented new internal security measures to ensure your data is safe. 7. We have implemented policies and systems that require us to continually monitor, assess and improve our data privacy and security practices. 8. Please note that Dubble, which is not part of the Paperform Platform but is owned by Paperform Pty. Ltd. is…

Paperform's DPA is built into the standard Paperform Terms. You are not required by Paperform to sign this agreement, but you can should your business require it. You can access the DPA via this form: https://paperform.co/data-processing-agreement/

Single Sign-On (SSO) is supported in Paperform on specific pricing plans By adding and configuring an SSO domain, users who exist on your provider can be authenticated with Paperform for SSO (also known as SAML). You can read more about setting this up in our Help Centre here

Yes, we enter into SLAs with all Enterprise customers , and define parameters for resolving identified security issues as part of that offering. We outline commitments to the handling of security issues for all other plans in our General Terms and Privacy Policy

We complete vendor assessment forms as part of our Enterprise offering. Please contact us at support@paperform.co, and our Enterprise Team will assist you in getting the answers you need.

Forms and submissions are stored in a database that is encrypted at rest. Form submissions are secured using TLS 1.2 SSL from the submitters browser through to our servers. SSL (Secure Sockets Layer) is the standard security technology for establishing an encrypted link between a web server and a browser. This link ensures that all data passed between the web server and browsers remain private and integral. SSL is an industry standard and is used by millions of websites in the protection of their online transactions with their customers.

2 Factor Authentication (2FA) supported on all Paperform plans

To make a request about the handling of your data, please complete this form https://paperform.co/account/gdpr-request or contact support@paperform.co To remove respondent data as a user, delete form submissions from your Paperform Dashboard, and these will be automatically permanently removed after thirty days. You can also request specific data to be removed if that timeframe doesn't work for you, by completing the request [form https://paperform.co/account/gdpr-request](form%20https://paperform.co/account/gdpr-request). Note that file uploads submitted by respondents must be manually requested to be removed as they are stored separately to submission data. We will delete and confirm that these have been deleted upon request. Note also that trial accounts will auto expire after the trial period has ended. The account will remain in a dormant state and retain its associated data. Should you wish for the account and it's data to be removed entirely, you need to make a GDPR request using the form mentioned above.

If you encounter a form created using Paperform that appears malicious or abusive, report it as soon as you can. We accept abuse reports via email at support@paperform.co, alternatively you can use our live chat support widget located at the bottom-right of your screen. We'll respond as soon as we're able, and ask for as much information as we can gather about the abuse. The main pieces of information we'll need are: - The URL or link to the abusive form - Why you think the form is abusive or malicious - Your email so that we can follow up with you We appreciate any report of abuse, and take action as a matter of priority. We also use these reports to build in preventative measures.