Trust & Security

Can you read my project data?

Technically, yes. The backend talks to the database with a service key that can read every row. That is how the dashboard renders your board and how the MCP tools write your cycles; there is no way to run this service without it.

What bounds that in practice: PAPI is a one-person company, so exactly one person (the founder) holds that access. He opens your project content only when you ask for support or a bug demands it. He reviews aggregate numbers (counts, durations, success rates) routinely; he does not read the text of your tasks and decisions.

What PAPI never does: read or store your source code. The tools your AI calls write structured project metadata only, task titles, cycle notes, decisions, the things you already see on your board. If you register a doc, only Markdown files are stored, and that is opt-in. The install layer itself (the MCP server and adapters) is source-available under the Elastic License 2.0 in the public getpapi/papi repo, so you can see exactly what runs on your machine before you connect it. The dashboard is MIT.

If “the operator could read it” is a dealbreaker for your project, PAPI is not the right home for that data today. We would rather you know that now.

Where does my data live?

On PAPI’s Netcup VPS in the EU. Your account and project data sit in a self-hosted Postgres/Auth stack (Supabase’s open-source project, no vendor account or cloud tie to Supabase Inc.) on that same production VPS — the same stack anyone can run themselves.

Around it: the dashboard and hosted MCP server (mcp.getpapi.ai) run on that VPS, and transactional email goes through Resend. Where a provider operates from the United States, transfers rely on standard contractual clauses; the privacy policy has the full detail.

How is access controlled?

Three doors, each locked separately.

• Dashboard: you sign in through Supabase Auth with email and password, or with your GitHub or Google account. Passwords are hashed by Supabase; we never see them.
• MCP server: every call carries a bearer token, either a papi_ API key or an OAuth access token. We store only SHA-256 hashes of these and compare them in constant time; the raw value is shown to you once and cannot be recovered by anyone, including us.
• Database: browser-facing paths use a restricted key where row-level security applies. Backend paths authenticate first, then scope every query to your account at the application layer, with row-level security behind it as a second net.

On top of that: every change to an Active Decision, confidence shifts, supersedes, resolutions, is appended to a log that is never edited or deleted. That covers architectural decisions specifically, not a general record of who viewed what.

Where your bearer token lives: once issued, the raw token sits in your AI tool’s own MCP config file (.mcp.json or equivalent) on your machine — the same pattern any HTTP-transport MCP server uses, not something specific to PAPI. We tell every install path to add that config file to .gitignore and, on a shared machine, to lock it to your account with chmod 600. Neither step is required for PAPI to work; both close the realistic exposure paths — an accidental commit, another local account reading the file. If a token does leak, revoke it from the Connect panel and issue a new one; nothing else needs to change.

Is it end-to-end encrypted?

No. End-to-end encryption would mean our servers cannot read your project state, and then they could not do their job: assemble planning context, render your board, carry decisions across sessions. A project intelligence layer that cannot read the project would be a filing cabinet.

What you do get: TLS on everything in transit, encryption at rest in Supabase, hashed passwords, and hashed API keys. We can read the database; we cannot sign in as you or recover your keys.

Does an AI model see my data?

The one you run, plus one narrow exception on our side. PAPI’s loop makes no AI calls from our servers: when you plan or review, the thinking happens inside the AI session you are already running, on your own subscription. We never train models on your content and never sell your data.

The exception: if you upload a brief file during onboarding, our backend sends its parsed text to Anthropic’s API once to extract structure, then discards the file. Anthropic’s commercial API is contractually committed not to train on that content. If you’d rather that one call ran under your own Anthropic account instead of ours, paste your own key in the upload step — it is used for that single extraction and then discarded, never stored. And if you configure your own Anthropic key for optional commands, those calls run from your machine with your key; we never see them.

Who else touches my data?

Seven providers, and each one gets only what its job requires:

That is the whole list. There are no advertising or tracking networks behind it. See the standalone sub-processors page for the canonical, linkable version of this list and how we notify you of changes.

Can I take my data out?

Export yes, deletion by email for now. Settings → Export gives you the whole project — tasks, decisions, conventions and cycles — as Markdown, JSON, or CSV, on every tier including Free. It is your project’s data, so export is never gated.

Full account deletion is not self-service yet. Email cathal@getpapi.ai from your account address and your account plus everything attached is hard-deleted within 30 days. You can already delete individual projects yourself from Settings. Self-service full account deletion is on the roadmap; we will not pretend it exists before it does.

What if PAPI disappears?

You would not be locked out of your own project. PAPI is one person and one hosted service. It could stop one day, and we would rather you plan for that than take our word that it never will.

Three things stand between you and that outcome:

• Your data leaves with you, today. Settings → Export gives you the whole project in formats another tool can read and reuse, with a format name and version so a reader can tell what it is. Export is not gated: it works on every tier, including Free.
• Material changes get notice, not silence. When the terms change in a way that matters — pricing mechanics, data handling, liability — registered users get an email before the change takes effect, and every change is noted in the changelog. The rules are not changed out from under an active subscription without that warning.
• The install layer can be run without us. The MCP server and the database adapters are source-available under the Elastic License 2.0, and the dashboard is MIT — both in the public getpapi/papi repo. You can read exactly what runs on your machine, and you can self-run that layer against your own database. The hosted service is a convenience, not the only way to use what you have built.

What this is not: a service-level guarantee, a data-processing agreement, or a promise of indefinite hosting. PAPI does not sell a DPA today, and nothing here commits the company to a term it cannot fund. If a signed legal instrument is a requirement for your data, PAPI is not there yet — the same honesty as the rest of this page.

What do you not have?

No SOC 2, no ISO 27001, no pentest report, no security team. PAPI is one person, and buying a badge the company cannot yet live up to would be theatre.

What stands in for those today: a small attack surface, deliberately boring choices (Supabase Auth, hashed credentials, TLS everywhere, one hosted path), and this page telling you plainly where the limits are. If your context requires certified infrastructure, PAPI is not there yet; when that changes, this page changes first.

Reporting a security issue

Found something? Email cathal@getpapi.ai and it goes to the top of the queue. You will get a reply from the person who can fix it, usually the same day.