Trust Center

paperplane is pre-launch and has not completed a formal security certification yet. This page is the honest version of that: exactly what we do today, in plain language, updated as it changes — not a badge shelf. If you need something not covered here for a vendor-security review, email help@sendpaperplane.com.

Certification status

SOC 2 Type II — not yet started. We'll update this page (and the site footer, which carries the same status) the moment that changes, rather than implying progress that isn't real.

Encryption

• In transit — every request to the site and API is served over HTTPS/TLS. No unencrypted endpoint exists.
• At rest — uploaded documents are stored encrypted and deleted 30 days after delivery; there is no long-term document archive to breach.
• Payment data — handled entirely by Stripe. Card numbers never touch our servers.

Payment: authorized, then captured only after screening

We never charge a card before we know the letter is going to print. Checkout places an authorization hold, not a charge; the card is captured only after the automated content screen passes and the letter is accepted for printing. If screening refuses the letter, or it's canceled first, the hold is released automatically — no charge, no refund request needed. If fulfillment ever fails after capture, an hourly reconcile job detects it and refunds automatically. The full state machine — every order status and what happens to the payment in each — is documented in the error & lifecycle contract.

Spend safety for agents (and everyone else)

A send is never the first call. Whether a human clicks a button or an AI agent calls the API, the actual send (POST /v1/orders, or the send_letter MCP tool) requires a single-use confirmation_token minted by the quote step (POST /v1/quotes / quote_letter), cryptographically bound to the recipient, document content, mail class, and price. Nothing about the letter can change between the quote a person or agent saw and the letter that gets mailed, and a reused token is rejected with confirmation_used rather than mailing — and charging for — a second letter. Live sends additionally require either a human-approved payment_url or a prepaid credit code, so an agent can prepare a mailing but can't silently pay for one. Full mechanics: Build with agents and the error contract's confirmation-error table.

Data handling & retention

• Documents: encrypted, used solely to print the letter, deleted 30 days after delivery.
• Addresses: kept in the order record for as long as the order itself is retained.
• Screening verdicts: the automated content-screen result (categories, not your letter's text) is retained for audit and legal compliance.
• Minimal order and tax records persist after document deletion, as required by law — see Privacy for the full policy.
• We never sell or advertise against customer data, and never use letter content to train models.

Subprocessors

Every third party that touches customer data, and why:

• Stripe — payment processing. Never receives document content.
• Vercel — application hosting and edge network.
• Supabase — encrypted document storage and the order database.
• Print-fulfillment partner — receives the rendered PDF and recipient/return addresses to physically print, stuff, and hand the letter to USPS. Nothing else.
• An email delivery provider — transactional receipts and delivery-status updates only, when an email is supplied.
• An address-verification provider — validates and standardizes the addresses on an order before printing.
• An AI provider — the automated content screen. Letter text is processed transiently for the screening decision and is not retained or used for training.

Access control

There is no customer login or account system by design — see the API docs — which means there is no customer password database to compromise. Sensitive actions (viewing or cancelling an order) require possession of an HMAC-signed, single-use token minted at checkout, not a reusable credential.

Incident response

If something happens that could affect your data, we'll email anyone whose order was affected (when an email was provided) and post to our status page. Report a suspected security issue to help@sendpaperplane.com; see also security.txt for the formal disclosure channel.

Uptime

Live status and incident history: paperplane Status.