Enterprise-grade security. Hosted on AWS. Protection for your project data you can rely on.
TLS 1.3 in transit, AES-256 at rest on our cloud infrastructure. Connected accounting credentials get an extra layer of encryption at the application level.
Your project data is stored in AWS data centres in Sydney, Australia. Fully compliant with local data protection laws.
2FA via SMS or authenticator app for an extra layer of account protection.
Role-based access so users only see what they need to.
Sign-ins, admin actions and deletions are logged with who, when, and from where.
Security lint and secret scanning on every change, plus weekly dependency audits and CodeQL code scans.
Information security management certification
Security and availability controls
Data handled in line with applicable privacy law, including the Privacy Act 2020 (NZ) for New Zealand customers
Your project data is stored in the AWS Sydney region, which means:
If something goes wrong, we work through it in four steps.
Automated monitoring that alerts us
Affected systems isolated
Affected users notified as privacy law requires
Fix, strengthen defences, post-mortem
Found a vulnerability? Report it responsibly and we commit to:
Email security@buildpaperless.ai with details. We respond within 24 hours.
We assess and reproduce the issue within 48 hours.
Critical issues patched within 7 days, others based on severity.
Coordinated disclosure after fix. Recognition for responsible reporting.