Encryption

Data is encrypted on your device using a local key, and ticket text — titles, notes, checklist items, tag labels — is encrypted at rest on the server. Both protect against a stolen device or a raw database read.

This is not end-to-end encryption. The at-rest key is held by Paperplane's backend, which can decrypt what it stores. If you need a guarantee that nobody but you can ever read a message, Paperplane does not provide it.

Endpoint keys

A channel can require an X-Paperplane-Endpoint-Key header on every event, so only systems you've configured can post to it. Keys are per-channel and rotatable from the app.

Personal access tokens

A token used by a script, CI job, or MCP connector is scoped and revocable, and is not your sign-in. Six scopes exist: events:write, channels:read, messages:read, messages:write, tickets:read, tickets:write. No token — however many scopes it holds — can create or delete a channel, rotate an endpoint key, manage members, or mint or revoke another token. Tokens are stored server-side only as a SHA-256 hash; the raw value is shown once.

The one exception worth naming: an ask sent through a token cannot be answered by that same token. Answering requires a signed-in human tapping in the app, so an agent cannot approve its own question.

Callbacks

A callback only calls http(s) endpoints, times out, and has a per-endpoint cooldown so a stray tap can't loop a webhook. Every trigger is logged with the response it got back.

Hosting

Paperplane is a hosted service. There is no self-hosting option, so there's no separate deployment to secure on your end — but it also means you're trusting Paperplane's infrastructure, not your own.