Built to touch your docs, and nothing else

Repository access

You connect Paperkraft by installing a GitHub App on the repositories you choose. It asks for the narrowest access that lets it work: it reads your code to see what changed, and it can only write to the paths where your docs live.

It never pushes straight to your main branch. Every change arrives as a pull request, runs your build, link and style checks, and is scored for risk by a separate review agent. New workspaces start with nothing merging on its own. You decide which kinds of change, if any, can merge without a person.

Your data

Paperkraft reads your source code to understand a change, then writes the docs update. The code is processed, not stored. What we keep is what you would expect to see in the product: your workspace settings, the docs changes we open and their history.

Data is encrypted in transit with TLS and encrypted at rest by our database provider. Data region and retention are planned as workspace settings, so teams with residency needs can choose where their data lives.

Application security

• HTTPS everywhere, with HTTP Strict Transport Security on every page.
• A strict Content Security Policy that blocks inline scripts and third-party code.
• The app cannot be embedded in other sites, which protects against clickjacking.
• No third-party scripts, analytics or trackers inside the app.
• Every change to the product goes through a reviewed pull request, and builds fail on type errors.

Accounts and sign-in

Paperkraft is invite-only. An email has to be added to a workspace before it can create an account, and sign-up requires a code sent to that inbox plus a password. Sign-up and password resets are rate limited, and changing a password signs out every other device.

AI providers

Paperkraft uses AI models to read changes and write docs. Your content is sent to a model provider only to do the work you asked for, under that provider's commercial data terms, which do not allow it to be used to train their models on our behalf.

Compliance

Paperkraft is in private beta and does not yet hold a SOC 2 report or offer a HIPAA business associate agreement. We are building the controls those require from the start: reviewed changes, access reviews, audit logging and a vendor register. If your team needs a security questionnaire or a data processing agreement, email us and we will work through it with you.

Subprocessors

These companies process data on our behalf. We will update this list before adding a new one.

Report a vulnerability

If you think you have found a security issue, email security@paperkraft.co with the details and steps to reproduce it. Please don't share it publicly until we have fixed it. We read every report and will keep you updated as we work on it.