Security

• All traffic between you and Papertrail is encrypted in transit with TLS (HTTPS).
• Sensitive credentials — including OAuth tokens and device tokens — are encrypted at rest.
• Account passwords are stored only as salted one-way hashes and are never recoverable in plain text.

Gmail is connected using read-only access (gmail.readonly). We read messages only to detect receipts and invoices — never to send email, modify your mailbox, or for any unrelated purpose. You can revoke access at any time from your Google Account or by disconnecting Gmail in settings.

Card payments are handled entirely by our PCI-compliant payment processor, Razorpay. Papertrail never sees or stores your full card number, CVV, or banking credentials. Webhooks from Razorpay are verified with a signed secret before they are trusted.

• Every request is authenticated, and data is scoped to the signed-in user — you can only ever see your own records.
• Sensitive server actions re-verify your identity and permissions on the server, not just in the browser.
• Access to production systems is limited to what is strictly required to operate the service.

You can permanently and irreversibly delete your account and all associated data at any time from Settings → Danger zone. Deletion removes your receipts, subscriptions, connected accounts, and profile, and cancels any active subscription.

If you believe you have found a security issue, we would genuinely like to hear from you. Please email meenasujal60@gmail.com with details and steps to reproduce, and give us a reasonable chance to respond before any public disclosure. We appreciate responsible reporting.