GDPR Compliance

1. Our Commitment to GDPR

PaperScale is designed from the ground up to comply with the General Data Protection Regulation (GDPR) (EU) 2016/679. We believe European data protection standards represent the gold standard for global software, and we extend these protections to all PaperScale users worldwide.

2. Our Role: Controller vs. Processor

Under GDPR terminology:

• PaperScale as Data Controller: We act as a Controller for your personal account information (your registration email address, billing records, and technical audit logs required to maintain service operation).
• PaperScale as Data Processor: We act as a Processor for the email communications, attachments, and recipient data that you transmit, store, and process through your PaperScale mailboxes. You remain the Data Controller of your own communications.

3. Data Residency: Frankfurt, Germany

We maintain complete European data sovereignty:

• Primary Compute & SES: Hosted in AWS Frankfurt (eu-central-1).
• Object Storage (Attachments & Raw MIME): Encrypted with AES-256 and stored exclusively in Frankfurt S3 buckets.
• Relational Database: Hosted on Neon Postgres in the Frankfurt availability zone.

Your email data never leaves the European Economic Area (EEA) without compliant transfer mechanisms.

4. Technical and Organizational Measures (TOMs)

We implement rigorous technical safeguards to ensure data security under Article 32:

1. Encryption in Transit: All connections to our webmail and APIs enforce modern TLS 1.3 encryption with strict HSTS headers.
2. Encryption at Rest: All emails, attachments, and database volumes are encrypted using industry-standard AES-256 encryption.
3. Tenant Isolation: Every customer’s email sending pipeline is isolated via dedicated Amazon SES tenant configurations, preventing unauthorized cross-tenant data access.
4. Access Control & Least Privilege: Production infrastructure access is restricted to authorized engineering personnel using multi-factor hardware keys.
5. Regular Backup & Disaster Recovery: Point-in-time recovery (PITR) is active for database systems to ensure rapid recovery from data incidents.

5. Exercising Your Data Subject Rights

Under GDPR Chapter III, you have the right to:

• Right to Access (Art. 15): Request a copy of all personal data held about you.
• Right to Rectification (Art. 16): Correct inaccurate or incomplete personal information.
• Right to Erasure (Art. 17): Request complete deletion of your account and communications.
• Right to Restriction of Processing (Art. 18): Restrict how your data is processed.
• Right to Data Portability (Art. 20): Export your complete message archive in machine-readable .mbox format.

To exercise any of these rights, or to request our standard Data Processing Agreement (DPA), contact:

[email protected]