What PaperTotal does to protect your records, and what it has not done yet.
Receipts carry card digits, names and spending. This page says plainly how they are handled.
In place today
- Encrypted transport
- Every connection to PaperTotal, from the website and the app to the API, runs over HTTPS.
- Card numbers masked before storage
- When PaperTotal reads a document, any run of 13 to 19 digits that passes the check used for card numbers keeps only its last four digits. That happens before the text is stored or logged. The image you sent stays as you sent it, so a receipt that prints a full number still shows one.
- Tenant isolation
- Every record belongs to one workspace, and every query is limited to that workspace. A record in another workspace answers as not found, so nobody can even learn that it exists.
Not done yet
PaperTotal has not completed a SOC 2 audit and holds no security certifications. If your organization needs one before it can use a vendor, PaperTotal is not ready for you yet.
Where to go next
The privacy policy names every company that handles your data for PaperTotal.
On the Business plan, people can sign in through your own identity provider. The single sign-on guide covers setup, SCIM and what to do if your provider locks you out.
To report a security problem, write to support@papertotal.com. For questions about your personal data, write to privacy@papertotal.com.