What happens to your money and data.

paperplane is pre-launch and has not completed a formal security certification yet. This page is the honest version of that: exactly what we do today, in plain language, updated as it changes — not a badge shelf. The sandbox is free and mails nothing. If you need something not covered here for a vendor-security review, email help@sendpaperplane.com.

Certification status

SOC 2 Type II — not yet started. We'll update this page the moment that changes, rather than implying progress that isn't real.

Encryption

• In transit — every request to the site and API is served over HTTPS/TLS. No unencrypted endpoint exists.
• At rest — uploaded documents are stored encrypted and deleted 30 days after delivery; there is no long-term document archive to breach.
• Payment data — handled entirely by Stripe. Card numbers never touch our servers.

Payment: authorized, then captured only after screening

We never charge a card before we know the letter is going to print. Checkout places an authorization hold, not a charge; the card is captured only after the automated content screen passes and the letter is accepted for printing. If screening refuses the letter, or it's canceled first, the hold is released automatically — no charge, no refund request needed. If fulfillment ever fails after capture, an hourly reconcile job detects it and refunds automatically. The full state machine — every order status and what happens to the payment in each — is documented in the error & lifecycle contract.

Spend safety for agents (and everyone else)

A send is never the first call. Whether a human clicks a button or an AI agent calls the API, the actual send (POST /v1/orders, or the send_letter MCP tool) requires a single-use confirmation_token minted by the quote step (POST /v1/quotes / quote_letter), cryptographically bound to the recipient, document content, mail class, and price. Nothing about the letter can change between the quote a person or agent saw and the letter that gets mailed, and a reused token is rejected with confirmation_used rather than mailing — and charging for — a second letter. Live sends additionally require either a human-approved payment_url or a prepaid credit code, so an agent can prepare a mailing but can't silently pay for one. Full mechanics: Build with agents and the error contract's confirmation-error table.

Data handling & retention

• Documents: encrypted, used solely to print the letter, deleted 30 days after delivery.
• Addresses: kept in the order record for as long as the order itself is retained.
• Screening verdicts: the automated content-screen result (categories, not your letter's text) is retained for audit and legal compliance.
• Minimal order and tax records persist after document deletion, as required by law — see Privacy for the full policy.
• We never sell or advertise against customer data, and never use letter content to train models.

Subprocessors

Every third party that touches customer data, and why:

• Stripe — payment processing. Never receives document content.
• Vercel — application hosting and edge network.
• Supabase — encrypted document storage and the order database.
• PostHog — product analytics: page views and interaction events from this website, sent through our own domain. Used to see which pages and steps people use; not used for advertising.
• Print-fulfillment partner — receives the rendered PDF and recipient/return addresses to physically print, stuff, and hand the letter to USPS. Nothing else.
• An email delivery provider — transactional receipts and delivery-status updates only, when an email is supplied.
• An address-verification provider — validates and standardizes the addresses on an order before printing.
• An AI provider — the automated content screen. Letter text is processed transiently for the screening decision and is not retained or used for training.

Vendor attestations

These are audits our vendors hold, not certifications of paperplane. They matter because your documents and payments pass through these systems. Each link goes to the vendor's own page.

• Payments — processed by Stripe, a PCI DSS Level 1 service provider.
• Hosting — Vercel holds a SOC 2 Type 2 attestation and ISO 27001:2022 certification (details).
• Database and document storage — Supabase is SOC 2 Type 2 compliant (details).
• Analytics — PostHog is SOC 2 Type 2 compliant (details).
• Print and address check — our print partner holds a SOC 2 Type II report covering print and mail and address verification, and its address check is CASS-certified, the USPS program that tests address-matching software.
• Email receipts — sent through a SOC 2 Type II email provider.
• Content screen — runs on an AI provider with SOC 2 Type 2 and ISO 27001 certification.

A vendor's certification covers that vendor's systems. It does not certify paperplane, and a CASS-certified address check improves deliverability but does not guarantee a letter arrives.

Access control

There is no customer login or account system by design — see the API docs — which means there is no customer password database to compromise. Sensitive actions (viewing or cancelling an order) require possession of an HMAC-signed, single-use token minted at checkout, not a reusable credential.

Incident response

If something happens that could affect your data, we'll email anyone whose order was affected (when an email was provided) and post to our status page. Report a suspected security issue to help@sendpaperplane.com; see also security.txt for the formal disclosure channel.

Uptime

Live status and incident history: paperplane Status.