Security
How Paperwise keeps your documents private.
What happens on your iPhone, what is encrypted and with which keys, what our servers can and can’t see, and where the limits are. This page is the short version; the whitepaper has every detail.
1. Processed on your iPhone
Page detection, clean-up, text recognition, file text, search, PDF export and the PDF tools run on your iPhone, with Apple’s Vision, Core Image and PDFKit. They work offline and send nothing.
Everything Paperwise stores is encrypted with its own key. Pages, originals, thumbnails, files, photos and videos, card photos, signatures and attachments are encrypted on your iPhone (AES-256-GCM, a random key per file, wrapped by a 256-bit vault key). The database of titles, recognised text, notes and tags has its own random key (SQLCipher). Both keys are kept in this iPhone’s Keychain for this device only: they never leave it, aren’t in iCloud Keychain or device backups, and the vault’s key never reaches the app’s JavaScript. On top of that, iOS Data Protection (class Complete) keeps the files unreadable whenever the phone is locked, and the vault’s files are left out of iPhone and Finder device backups.
Readable only while you use it. A readable copy exists only while you scan, view, edit or share, or for one on-device tool call, and is deleted when you’re done and again at every launch. Images on screen are decrypted in memory. Sync, the backup, share links and hiding re-encrypt from one key to another in memory, without a readable copy.
This iPhone only. Because the vault’s key never leaves the iPhone, a phone-to-phone transfer or an iPhone device backup can’t open your vault; Paperwise’s encrypted iCloud backup or sync can. Restored and synced files are encrypted again under the new iPhone’s own key. Files from earlier versions of the app are encrypted in place, in the background, the first time the new version opens.
The vault’s key isn’t behind Face ID, so sync and backup work with the app lock off. Hidden adds keys only Face ID, your Hidden passcode or your recovery key open. The app lock asks for Face ID to open Paperwise. It’s offered, switched on, during the first run of a new install (also after restoring from the iCloud backup), and turning it off asks for Face ID first; with it off, the vault opens without Face ID. IDs, medical, bank and tax papers are protected by their type either way: their previews are blurred, and opening, sharing or exporting them asks for Face ID. Hidden always needs Face ID.
2. Keys and where they live
The keys that open your synced, backed-up and Hidden content exist only on your devices, protected by the Keychain, Face ID and, if you choose, your own Hidden passcode. Your account key is created on your first device and never reaches our servers in readable form; we hold it only wrapped by your recovery key, which you keep.
Two exceptions, by design: a share link carries its own key, inside the link you send, and the public key of your email inbox lets our server seal mail to you.
The cryptography is standard and well studied: AES-256-GCM X25519 HKDF-SHA-256 Argon2id, from Apple CryptoKit and established libraries. No home-made ciphers.
4. Sync and backup: locked boxes
Free encrypted iCloud backup. Opt-in, and stored in your own iCloud. It’s encrypted on your iPhone with a key protected by your recovery key, so Apple sees how many records there are, their sizes and dates, but can’t open your documents. Because your documents are left out of iPhone device backups, this is the backup to turn on.
Sync across iPhone and iPad Pro Every item has its own key, wrapped by your account key. Titles, text, folders and page lists are encrypted together; images and files separately. Your device uploads ciphertext straight to storage. Every change is signed with your account key, and your devices check every version, so a stolen session or a break-in on our servers can’t forge your items or pass off an old version as new (a server could still delay or hold back changes; the app reports items that don’t arrive). Hidden items stay double-encrypted, each space under its own key.
Adding a device works by scanning a code shown on the new device: the secret travels only in the code, so our server just relays a sealed box it can’t open.
5. Forward by email: sealed on arrival Pro
You get a private address. When an email arrives, our mail handler checks the address and your optional approved senders, seals every attachment, the text, the sender, the subject and the file names to your inbox’s public key, stores only the sealed result and drops the plain text. The private key exists only on your devices.
The honest limit: email isn’t end-to-end encrypted. The sender and their email provider see the message, and our handler reads it for the moment it takes to seal it. Your approved-senders list is stored readable, so we can check it. Dangerous attachments, such as programs and scripts, aren’t stored.
7. What we can see
What we store for you is encrypted before it leaves your device or, for email, sealed the moment it arrives. We also keep the account, device and usage records below, some of them readable. No analytics or advertising SDKs, and no crash reporter.
| Area | We can see | We can’t see |
|---|---|---|
| Page processing (clean-up, text recognition, search, PDF export and tools) | Nothing: it runs on your iPhone | The pages, the text, the files |
| AI actions you start, and automatic naming of new items with “Name and sort new scans” on (Pro) | That document’s text, or a page image (Read handwriting, Extract, Count, “Keep the layout”), in memory while the request runs, forwarded to our AI provider without a user or install identifier | Hidden items and “Never send to AI” documents (never sent). We don’t store the content after the response |
| Word, Excel and PowerPoint conversion | The title and recognised text lines (Word, Excel) or the page images (PowerPoint), in memory for seconds, then discarded | Anything after the response is sent |
| Account | A keyed hash of your Apple identifier; devices (name, which is your iPhone’s model by default and reset to it at each sign-in, platform, public keys, push tokens, last seen about once a day); session hashes; Pro status | Your Apple email; your keys |
| Purchases | Apple and RevenueCat see your purchases and an app user id; we ask RevenueCat only whether an install is Pro | Your documents |
| AI usage counts | How many AI actions and namings each paying install used, kept 35 days | What the actions were about |
| Sync | Number, sizes, versions and dates of encrypted items, hidden ones included; deletion records | Titles, text, folder names, images, file names |
| Forward by email | That a message arrived, its size and number of parts; your approved-senders list, in readable form; your current and past addresses | Sender, subject, file names, contents (sealed on arrival) |
| Share links | Size, expiry, open count, failed attempts; IP addresses only briefly, for rate limits | The document, its title, the link key, the password |
| Server logs | Per request: route, status, timing and a short hash prefix of the install id | Request bodies, document contents, email addresses, names or subjects |
How long we keep things
| What | Kept |
|---|---|
| Forwarded email waiting for your devices (sealed) | Until the app downloads it, at most 30 days |
| AI usage counts | 35 days, also after account deletion |
| Sessions | Until 90 days without use |
| Share-link files | Deleted at once when you turn a link off; up to about 24 hours after expiry |
| Sync deletion records | For the life of the account |
| Past email addresses | Kept retired so they’re never given to someone else |
| Database history (Cloudflare D1 Time Travel) | About 30 days of point-in-time history |
| Our AI provider (OpenAI) | May keep AI requests up to 30 days for abuse monitoring |
| RevenueCat | Under RevenueCat’s policy; not deleted with your account |
The complete tables are in the whitepaper, §9.
8. AI: only when you allow it Pro
Nothing goes to AI until you allow it. The AI helper is off on a new install. Before AI first reads a document, the app tells you it isn’t fully private while AI reads it (Continue, Cancel, or “Don’t ask again for this document”). With Pro’s “Name and sort new scans” on, you’re told once, and it names only items added on that iPhone afterwards, never older ones. Documents that used AI show a small AI badge.
What’s sent: the document’s text for most actions; a page image for Read handwriting, Extract, Count and “Keep the layout”. Our server processes it in memory and forwards it to our AI provider, OpenAI, with storage turned off and without any user or install identifier. OpenAI doesn’t train on API data, but under its standard terms it may keep requests up to 30 days for abuse monitoring; we don’t have a zero-data-retention agreement yet.
Hidden items and documents marked “Never send to AI” are never sent; no request is made. AI limits: 20 actions a day and 300 a month, plus up to 100 namings a day.
9. Limits we’re honest about
What Paperwise can’t protect against, and what is still weaker than we’d like.
- The vault’s key is on the iPhone
- Everything Paperwise stores is encrypted with its own key, but the vault’s key sits in this iPhone’s Keychain, not behind Face ID, so sync and backup work with the app lock off. Something running as Paperwise on your unlocked iPhone (malware, a jailbreak) could read the vault; a copy of the app’s files alone can’t. Readable copies exist while you scan, view, edit or share. Turn the app lock on and keep your most private papers in Hidden, whose keys also need Face ID.
- A lost recovery key
- If you lose all your devices and your recovery key, nobody can recover your synced or backed-up data, including us.
- A compromised phone
- Malware or a jailbreak in control of your phone while Hidden is open can see what you see.
- Coercion
- Someone who forces you to unlock sees the space you open. Separate spaces and the emergency passcode reduce this risk; they can’t remove it.
- Hidden opens with Face ID alone by default
- Without a Hidden passcode, Hidden is exactly as strong as Face ID on that phone. Add a code or pattern for a second factor.
- Email in transit
- Email isn’t end-to-end encrypted. The sender and their provider see the message before it reaches us.
- AI and conversions while they run
- While an AI request or a conversion you started runs, its text or pages are readable by our processing engine (and, for AI, by OpenAI, which may keep requests up to 30 days for abuse monitoring). We don’t store them.
- Metadata
- Sizes, times, counts, devices and usage counts are visible to us, and some of it outlives the data it describes.
- Server history
- Deleted server records stay in our database provider’s history for about 30 days. They stay encrypted, but an old recovery key can open an old copy of your key escrow during that window. Rotating the account key is planned.
- Removing a device
- It stops the device syncing, but a device that already holds your account key keeps it until account-key rotation, which is planned.
- Share recipients
- Anyone with the whole link can open it until it expires, is used up or is turned off, sees the document’s title and file name, and can save a copy.
- Screenshots
- Blocking screenshots in Hidden is best effort: iOS can’t stop every capture, such as another camera pointed at the screen.
- Not yet in place
- Certificate pinning (the current test builds use ordinary TLS checks), a zero-data-retention agreement with our AI provider, and an independent security audit are all planned, not done.
10. Report a vulnerability
Write to security@paperwise.app with details and steps to reproduce. We acknowledge reports within 3 business days. Please give us reasonable time to fix an issue before you disclose it, and don’t access other people’s data or degrade the service while testing. We’ll credit researchers who wish to be named.
An independent security audit is planned, and we’ll publish the report. Our security.txt lists the same contact.