Trust & Security
Straight answers to the questions we would ask before handing anyone our project data. Some of these answers are uncomfortable. We give them anyway, because a vague assurance would tell you nothing.
Can you read my project data?
Technically, yes. The backend talks to the database with a service key that can read every row. That is how the dashboard renders your board and how the MCP tools write your cycles; there is no way to run this service without it.
What bounds that in practice: PAPI is a one-person company, so exactly one person (the founder) holds that access. He opens your project content only when you ask for support or a bug demands it. He reviews aggregate numbers (counts, durations, success rates) routinely; he does not read the text of your tasks and decisions.
What PAPI never does: read or store your source code. The tools your AI calls write structured project metadata only, task titles, cycle notes, decisions, the things you already see on your board. If you register a doc, only Markdown files are stored, and that is opt-in. The install layer itself (the MCP server and adapters) is source-available under the Elastic License 2.0 in the public getpapi/papi repo, so you can see exactly what runs on your machine before you connect it. The dashboard is MIT.
If “the operator could read it” is a dealbreaker for your project, PAPI is not the right home for that data today. We would rather you know that now.
Where does my data live?
On PAPI’s Netcup VPS in the EU. Your account and project data sit in a self-hosted Postgres/Auth stack (Supabase’s open-source project, no vendor account or cloud tie to Supabase Inc.) on that same production VPS — the same stack anyone can run themselves.
Around it: the dashboard and hosted MCP server (mcp.getpapi.ai) run on that VPS, and transactional email goes through Resend. Where a provider operates from the United States, transfers rely on standard contractual clauses; the privacy policy has the full detail.
How is access controlled?
Three doors, each locked separately.
- Dashboard: you sign in through Supabase Auth with email and password, or with your GitHub or Google account. Passwords are hashed by Supabase; we never see them.
- MCP server: every call carries a bearer token, either a
papi_API key or an OAuth access token. We store only SHA-256 hashes of these and compare them in constant time; the raw value is shown to you once and cannot be recovered by anyone, including us. - Database: browser-facing paths use a restricted key where row-level security applies. Backend paths authenticate first, then scope every query to your account at the application layer, with row-level security behind it as a second net.
On top of that: every change to an Active Decision, confidence shifts, supersedes, resolutions, is appended to a log that is never edited or deleted. That covers architectural decisions specifically, not a general record of who viewed what.
Where your bearer token lives: once issued, the raw token sits in your AI tool’s own MCP config file (.mcp.json or equivalent) on your machine — the same pattern any HTTP-transport MCP server uses, not something specific to PAPI. We tell every install path to add that config file to .gitignore and, on a shared machine, to lock it to your account with chmod 600. Neither step is required for PAPI to work; both close the realistic exposure paths — an accidental commit, another local account reading the file. If a token does leak, revoke it from the Connect panel and issue a new one; nothing else needs to change.
Is it end-to-end encrypted?
No. End-to-end encryption would mean our servers cannot read your project state, and then they could not do their job: assemble planning context, render your board, carry decisions across sessions. A project intelligence layer that cannot read the project would be a filing cabinet.
What you do get: TLS on everything in transit, encryption at rest in Supabase, hashed passwords, and hashed API keys. We can read the database; we cannot sign in as you or recover your keys.
Does an AI model see my data?
The one you run, plus one narrow exception on our side. PAPI’s loop makes no AI calls from our servers: when you plan or review, the thinking happens inside the AI session you are already running, on your own subscription. We never train models on your content and never sell your data.
The exception: if you upload a brief file during onboarding, our backend sends its parsed text to Anthropic’s API once to extract structure, then discards the file. Anthropic’s commercial API is contractually committed not to train on that content. If you’d rather that one call ran under your own Anthropic account instead of ours, paste your own key in the upload step — it is used for that single extraction and then discarded, never stored. And if you configure your own Anthropic key for optional commands, those calls run from your machine with your key; we never see them.
Who else touches my data?
Seven providers, and each one gets only what its job requires:
| Service | What they handle |
|---|---|
| Netcup | EU VPS infrastructure for the dashboard, MCP server, database, sign-in, and storage. |
| Supabase (self-hosted, open-source) | The database/auth/storage software itself, running on Netcup above — not a Supabase Inc. account or cloud service. No production data ever reaches Supabase Inc.’s own infrastructure. |
| Stripe | Billing. Your card goes straight to Stripe; we only ever see subscription status. |
| Resend | Transactional email (signup, reset, magic links). |
| Anthropic | Brief text during import, as described above. No training on your content. |
| GitHub | Sign-in identity and public-repo access, only if you connect it. |
| Sign-in identity (email and profile), only if you use it. |
That is the whole list. There are no advertising or tracking networks behind it.
Can I take my data out?
Export yes, deletion by email for now. You can export your board to CSV from the dashboard today, on every tier including Free.
Full account deletion is not self-service yet. Email cathal@getpapi.ai from your account address and your account plus everything attached is hard-deleted within 30 days. You can already delete individual projects yourself from Settings. Self-service full export and deletion are on the roadmap; we will not pretend they exist before they do.
What do you not have?
No SOC 2, no ISO 27001, no pentest report, no security team. PAPI is one person, and buying a badge the company cannot yet live up to would be theatre.
What stands in for those today: a small attack surface, deliberately boring choices (Supabase Auth, hashed credentials, TLS everywhere, one hosted path), and this page telling you plainly where the limits are. If your context requires certified infrastructure, PAPI is not there yet; when that changes, this page changes first.
Reporting a security issue
Found something? Email cathal@getpapi.ai and it goes to the top of the queue. You will get a reply from the person who can fix it, usually the same day.