Document Management (DMS)
PaperOffice
Provenance unknown Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by PaperOffice · www.paperoffice.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
PaperOffice at a glance
- Vendor
- PaperOffice
- Headquarters
- Not stated on the vendor’s pages as of 20 Oct 2026
- Data hosting
- Default not stated; pages mention the EU source, captured 20 Oct 2026
- Free plan
- Not stated on the vendor’s pages as of 20 Oct 2026
- Panel verdict
- The AI panel rates PaperOffice 3/5, the mean of 6 judges. PaperOffice is a document management system from PAPEROFFICE ENTERPRISE OPERATIONS, S.L.U. how scores are made
- As of
- Vendor pages captured 20 Oct 2026; evaluated by the panel 21 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
PaperOffice is a document management system from PAPEROFFICE ENTERPRISE OPERATIONS, S.L.U. of Pamplona, Spain, a brand founded in Germany in 2002. Capture and indexing is the strongest area, scored 8-9: intake runs through scanner SFTP, watched folders, an IMAP mailbox connector, upload and a REST API, OCR reads more than 120 languages, and e-invoices in XRechnung, ZUGFeRD and Factur-X validate against EN 16931. Versioning and permissions and search and portability follow, anchored by an audit trail whose entries can be changed or deleted neither in the app nor via the API, and a SHA-256 checksum per version. Pricing transparency is the weakest criterion at 3: only per-page OCR prices ($0.01 basic, $0.02 premium, $0.03 ultra) and a credit-billed API are public. Sovereignty shows the widest spread, 4-6, between the stated own EU data center with no US cloud and a San Jose sales-and-support office, AI assistants that can search the archive, and no public information on subprocessors or ownership; the flagged split check flagged none. Persona-weighted totals run from 5.7 to 6.6.
Speaks for it
- An audit trail whose entries can be changed or deleted neither in the app nor via the API
- Every revision kept as its own version with a SHA-256 checksum, sealed documents under WORM protection until the retention term ends
- Classification determines document type, sender and direction, proposes the matching retention rule, and routes uncertain values to a review list, with duplicate detection documented
- Search across full text, OCR text and semantics at summary, page and paragraph level, restricted to workspaces the user is authorized for
- A REST API on every plan with published endpoints and limits, signed webhook events with retries, and MCP tools for Claude, ChatGPT and Cursor
Held against it
- Only unit prices are public — OCR at $0.01 per page for basic, $0.02 for premium and $0.03 for ultra, plus a credit-billed API — while the plan names Basic, Premium, Ultra and Corporate appear with no per-user or per-month price
- OAuth sign-in for Microsoft 365 mailboxes is not supported yet, per the captured pages
- Automation is rule-based Workflow Agents for intake, follow-up and filing, with no public information on graphical workflow modelling or ERP and DATEV handover
- GoBD-relevant archiving rests on the vendor's own pages, with no public information on an auditor's report such as IDW PS 880, a Z1–Z3 export or a sample Verfahrensdokumentation
- No public information on subprocessors, a data processing agreement or the ownership behind the Spanish contracting entity, while a US office in San Jose handles sales and support
Best for
- You need audit-resistant recordkeeping under German retention terms — WORM until term end, retention per document type with legal basis, a legal hold and a logged release — for six-, eight- and ten-year obligations
- You want files kept on your own NAS or server over SFTP while search and AI processing run in the vendor's EU data center, accepting that index and metadata stay in that data center
- You integrate programmatically — the full REST API is on every plan billed in credits, webhook events are signed with retries, MCP tools expose the archive to Claude, ChatGPT and Cursor, and the quickstart downloads free without registration
- You receive German e-invoices and must validate them — XRechnung (UBL and CII), ZUGFeRD and Factur-X are checked against EN 16931, with free tools to create and check them
Avoid if
- You must put a budget on the table before committing — the public pages carry no per-user or per-month plan price, only per-page OCR units and credit-billed API use
- Your intake depends on Microsoft 365 mailbox sign-in — the captured pages state that OAuth sign-in, as with Microsoft 365, is not supported yet
- You need designed approval workflows that hand invoices over to DATEV or an ERP — the documented automation is rule-based Workflow Agents for intake, follow-up and filing
- You want an independently attested compliance archive before signing — the captured pages name GoBD as a regulatory reference and leave the final assessment to your tax advisor
The scores
| Criterion | Panel median |
|---|---|
| Capture, OCR & indexing | 4 of 5 |
| Versioning, permissions & audit trail | 3.5 of 5 |
| Audit-proof archiving & retention | 3 of 5 |
| Document workflows & integrations | 3 of 5 |
| Search, retrieval & exit | 3.5 of 5 |
| European sovereignty | 2.5 of 5 |
| Pricing transparency | 1.5 of 5 |
Capture, OCR & indexing
Show reasoningHide reasoning
How this is scored
How documents get in and become findable: scanning and email intake, OCR, classification and metadata extraction, and whether incoming e-invoices (XRechnung, ZUGFeRD) are read as structured data rather than as pictures.
0 — Manual upload only; no OCR, no metadata beyond file name and folder.
3 — Upload, drag-and-drop and scan import with OCR mentioned, but indexing is manual and no word on email intake or e-invoice formats.
5 — Scanner, email and folder intake, full-text OCR, document types with metadata fields, and automatic extraction of common fields (date, sender, amount) documented.
8 — AI- or rule-based classification and field extraction with confidence and a validation step, XRechnung and ZUGFeRD read as structured data, mailbox and Microsoft 365 intake, and duplicate detection documented.
10 — Capture is engineered and shown: classification and extraction trainable per document type, validation queues, e-invoice validation against the standard, intake channels listed with their limits, and where AI processing runs (location, model provider) stated.
The GoBD Auditor
Intake channels are listed with their real limits (scanner over SFTP, watched folders, an IMAP mailbox connector from five-minute intervals with Microsoft 365 sign-in not yet supported), classification determines type, sender and direction and proposes the retention rule, fields carry confidence and land in a review queue, and duplicate detection and EN 16931 validation of XRechnung and ZUGFeRD are documented. We found no public information on training classification per document type or on the model provider behind the AI. 2 5 6 10
The Records Manager
Intake is documented from scanner, watched folders, email and upload with connectors on stated intervals, and capture does the work I care about: classification sets document type, sender and direction and proposes the retention rule at filing time, fields carry confidence, uncertain values go to a review list, and duplicates are flagged. XRechnung and ZUGFeRD are validated against EN 16931, and processing is stated to run in the vendor's own EU data center on its own GPU hardware. It stops short of the top because classification is not documented as trainable per document type and Microsoft 365 mailbox sign-in is not supported yet. 2 5 6 8 10
The IT Integrator
Intake is broad with stated mechanics — scanner over SFTP, watched folders, IMAP mailbox, upload, REST API and webhook-triggered connector runs with intervals and post-import rules — and classification determines type, sender and direction, proposes the retention rule, carries per-field confidence into a review list, with duplicate detection documented. E-invoices are supported as XRechnung (UBL and CII), ZUGFeRD and Factur-X in profile EN 16931 and OCR is stated to run in the vendor's own EU data center, though we found no public information on the model provider or on training classification per document type, and mailbox sign-in "as with Microsoft 365 is not supported yet". 2 5 6 9 10
The Mittelstand Owner
E-invoices arrive as XRechnung and ZUGFeRD and get checked against EN 16931, mail lands in the archive from any mailbox with stated intervals and limits, and classification with confidence values, a review queue and duplicate detection are all documented. The connector works with user name and password — Microsoft 365 sign-in is stated as not yet supported — and we found no public information on training the classification per document type or which model provider does the reading. 2 5 6 10
The Data Protection Officer
Intake runs through a scanner inbox over SFTP, watched folders, a mailbox connector with stated intervals (the captured pages say Microsoft 365 OAuth sign-in is not supported yet), upload, API and webhook; OCR covers more than 120 languages, every field carries a confidence value, uncertain results go to a review list or quarantine, and duplicate detection is documented. E-invoices in XRechnung, ZUGFeRD and Factur-X can be created and validated against EN 16931, and — decisive for me — OCR and analysis run in the vendor's own EU data center. I found no public information on training the extraction per document type. 2 5 6 10
The Skeptic
Intake is documented with its limits — scanner via SFTP, watched folders, IMAP mailbox and upload, with OAuth sign-in as with Microsoft 365 explicitly stated as not yet supported — and classification proposes type, sender and retention rule with per-field confidence, a review list, duplicate detection and XRechnung/ZUGFeRD validation against EN 16931. It stops short of the top because we found no public information naming the model provider behind the AI processing, and Microsoft 365 mailbox intake is documented as not yet supported. 2 5 6 10
Versioning, permissions & audit trail
Show reasoningHide reasoning
How this is scored
Who may see and change which document, what happened to it, and whether earlier states can be recovered: version history, check-in and check-out, role- and attribute-based rights, and an audit trail of reads and changes.
0 — Files overwrite each other; rights only at folder level or not described; no log of who did what.
3 — Version history and folder permissions exist, but no check-out, no record-level rights and no documented audit log.
5 — Version history with restore, check-in and check-out, roles and groups with document-type or record-level rights, and an audit log of changes documented.
8 — Metadata-driven permissions (by department, client or confidentiality), audit trail covering reads, exports and deletions, single sign-on and directory sync (Entra ID, LDAP) documented, and administrators' own actions logged.
10 — Access is provable: the audit trail is tamper-evident and exportable, permission changes are themselves versioned, field-level rights and need-to-know access for HR or legal records documented, and the log retention period stated.
The GoBD Auditor
Every revision becomes a version with its own SHA-256 checksum, the audit trail records who changed which field when with old and new values and admits no change or deletion in app or via API, and rights are read/write/admin per workspace with accesses and level changes logged. We found no public information on check-in and check-out, single sign-on or directory sync, export of the audit trail itself, or the log's retention period. 4 7 8 9
The Records Manager
Every revision is kept as a version with its own SHA-256 checksum, and for revision-secure documents the audit trail shows who changed which field when, with old and new values, with no function in the app or via the API to change or delete entries. Rights run per workspace for users and groups with read, write and admin levels, plus a read-only auditor account confined to one workspace. We found no public information on single sign-on or directory sync, check-in and check-out, restore of an earlier version, or how long the log is kept. 2 4 7 8 9
The IT Integrator
The audit side is unusually solid: entries in the audit trail cannot be changed or deleted in the app or through the API, every access and level change is logged, and for revision-secure documents the trail shows who changed which field when, with old and new values. Rights, however, exist only as read, write and admin per workspace, and we found no public information on single sign-on, directory sync with Entra ID or LDAP, check-in and check-out, or restoring earlier versions — the identity integration I need to run this next to Microsoft 365. 4 7 8 9
The Mittelstand Owner
Every version carries a checksum, changes sit in the audit log with time and person, entries in that log cannot be changed or deleted even via the API, and rights run per workspace for users and groups. We found no public information on single sign-on or directory sync, check-in and check-out, field-level rights, or how long the log is kept. 4 7 8
The Data Protection Officer
Every revision is kept as its own version with a SHA-256 checksum, rights are set per workspace for users and groups at read, write and admin levels, and the audit trail records every access and every field change with person, time, old and new value — entries cannot be changed or deleted in the app or via API. For personnel files I found no public information on single sign-on or directory sync, on check-in and check-out, or on whether administrators' own actions and permission changes are themselves logged. 3 4 7 8
The Skeptic
Every revision survives as its own SHA-256-checksummed version, changes on revision-secure documents are logged with time, person and old and new field values, and audit entries can be neither changed nor deleted in the app or via the API — that is unusually concrete. It stays short of the top because rights sit at workspace level, and we found no public information on check-in and check-out, single sign-on or directory sync, field-level rights, or how long the log is retained. 4 7 8 9
Audit-proof archiving & retention
Show reasoningHide reasoning
How this is scored
GoBD-compliant, revisionssicher archiving: immutability of archived documents, retention schedules and deletion, tax-audit data access, and the independent evidence behind the claim — scored on what is certified and documented, not on the word "GoBD-konform".
0 — No statement on archiving, retention or GoBD.
3 — "GoBD-konform" or "revisionssicher" claimed with no certificate, no description of how immutability is achieved and no retention settings documented.
5 — Archived documents documented as unchangeable, retention periods configurable per document type, deletion after expiry, and a sample Verfahrensdokumentation or GoBD guidance offered.
8 — An auditor's report (IDW PS 880 or comparable) published or named with its scope and date, WORM or equivalent storage described, legal hold, GDPR deletion reconciled with retention duties, and Z1–Z3 tax-audit export documented.
10 — Archiving is evidenced end to end: current Testat with scope covering the cloud and on-premises editions as sold, retention and deletion logged and reportable, long-term formats (PDF/A) enforced, and a documented procedure for the tax audit and for moving the archive without breaking its integrity.
The GoBD Auditor
WORM protection until the retention end, retention period and legal basis per document type with a chosen start date, German retention terms of 8, 10 and 6 years, a legal hold, and the lifting of the WORM lock logged as an event are all genuinely documented. The independent evidence is what I miss: we found no public information on an auditor's report (IDW PS 880 or comparable) with scope and date, on a Z1–Z3 tax-audit export, on PDF/A long-term formats, or on a sample Verfahrensdokumentation, and the vendor itself leaves the final GoBD assessment to the tax advisor. 7 8 9
The Records Manager
Sealed documents sit under WORM protection until the retention term ends, retention period and legal basis are set per document type with the end date and days remaining shown on the document, expiry is logged, deletion stays a manual step, and a legal hold blocks it. The tax audit is served with a read-only account on one workspace and an export of metadata together with the original files, and German retention periods of six, eight and ten years are spelled out. We found no public information on an auditor's report, a sample Verfahrensdokumentation, Z1–Z3 export or enforced long-term formats; GoBD is named as a regulatory reference and the final assessment is left to the tax advisor. 7 8 9
The IT Integrator
The retention mechanics are documented in detail: WORM protection per document type with legal basis and a start date chosen at sealing, the term end lifting the lock and being logged as an event, deletion only by hand, legal hold, a SHA-256 checksum per version, and a read-only auditor user with metadata-and-originals export. The evidence is the vendor's own account — GoBD is named as a regulatory reference and the vendor leaves the final assessment to the tax advisor — and we found no public information on an auditor's report such as an IDW PS 880 Testat, a sample Verfahrensdokumentation, or Z1–Z3 tax-audit export. 7 8 9
The Mittelstand Owner
WORM protection with retention per document type and legal basis, a legal hold and a logged release after the term are well described, and the German retention periods are spelled out — but it rests on the vendor's own description. We found no public information on an auditor's report such as IDW PS 880, a sample Verfahrensdokumentation or a Z1–Z3 export for the tax office, and the vendor pages themselves put the final GoBD assessment with the tax advisor. 7 8 9
The Data Protection Officer
Sealed documents sit under WORM protection until the retention term ends, retention periods and legal basis are configured per document type with a chosen start date, the lift at term end is logged, a legal hold blocks deletion, and the GDPR access-request flow checks retention obligations first and exports redacted copies, with deletions documented in the audit trail. GoBD is named as a reference with the final assessment left to the tax advisor; I found no public information on an auditor's report such as IDW PS 880, on a Z1–Z3 tax-audit export, or on a sample Verfahrensdokumentation. 3 7 8 9
The Skeptic
The mechanics are written down in detail — WORM until term end, per-type retention with chosen start date and legal basis, a logged term end, manual-only deletion and legal hold — and GoBD guidance with the German retention periods is offered. But the claim rests on the vendor's own pages: we found no public information on an auditor's report such as IDW PS 880 or a current Testat, on a sample Verfahrensdokumentation, or on Z1–Z3 tax-audit export, and the vendor itself places the final GoBD assessment with the tax advisor. 3 8 9
Document workflows & integrations
Show reasoningHide reasoning
How this is scored
What happens to a document after it arrives: approval and invoice workflows, tasks and deadlines, and the connectors that tie the DMS to ERP, accounting, DATEV, Microsoft 365 and the rest of the stack.
0 — No workflows; documents are stored and nothing else.
3 — A fixed approval or sharing step and a handful of named integrations, with no workflow designer and no API documentation.
5 — A workflow designer for approvals and invoice processing, tasks with deadlines and substitutes, Microsoft 365 or Outlook integration, and a documented REST API.
8 — Graphical workflow modelling without code, invoice workflow with ERP or DATEV handover documented, connectors for named ERP systems (SAP, Microsoft Dynamics, DATEV) with their scope, webhooks or events, and e-signature integration.
10 — Workflows are a platform: versioned workflow definitions, process reporting with throughput times, a public API reference with rate limits and a sandbox, a partner marketplace of integrations with stated maintainers, and workflow history kept in the audit trail.
The GoBD Auditor
The REST API is properly documented with endpoints, limits, a quickstart, signed webhook events with retries, and MCP tools for Claude, ChatGPT and Cursor, and rule-based Workflow Agents cover intake, follow-up and approval steps with deadline fields and owners on the document. For the German stack we found no public information on DATEV or ERP handover, a graphical workflow designer, substitutes, or e-signature beyond the word itself. 2 10 11
The Records Manager
There is a documented REST API with limits, a free API quickstart, signed webhook events such as document.processed with retries, and an MCP server that lets Claude, ChatGPT and Cursor query the archive; e-signatures and two-person approvals are named. 2 4 10 11
The IT Integrator
This is stated scope rather than a logo wall: connectors monitor SFTP, S3, WebDAV, IMAP mailboxes and the scanner inbox with configurable intervals, post-import rules, reverse SSH and a live log; webhook events are signed, filterable per workspace and retried on failure; and the REST API documentation lists endpoints and limits, with a quickstart free to download. For the stack I maintain, we found no public information on DATEV or named ERP connectors, on a graphical workflow designer, or on tasks with substitutes — workflows are described as rule-based agents for intake, follow-up and filing, and mailbox sign-in "as with Microsoft 365 is not supported yet". 2 5 10 11
The Mittelstand Owner
The interfaces are strong — a full REST API on every plan with credits, signed webhooks, and connectors for SFTP, S3, WebDAV and email — but we found no public information on a graphical workflow designer or an invoice approval flow that hands over to DATEV or any ERP. Deadlines and follow-ups carry owners, and two-person or SMS approval is documented, though for workspace access rather than for approving an invoice. 2 4 10 11
The Data Protection Officer
Intake, filing and follow-ups run as rule-based Workflow Agents with approvals up to two-person confirmation, signed webhook events with retries, e-signature support, and a REST API whose endpoints and limits are published alongside an MCP server. I found no public information on graphical workflow modelling or an invoice handover to ERP or DATEV, and the captured pages state that Microsoft 365 OAuth sign-in for the mailbox connector is not supported yet. 2 4 10 11
The Skeptic
The interface side is real — a documented REST API with limits and a free quickstart, signed webhook events with retries, MCP tools in Claude, ChatGPT and Cursor, connectors over SFTP, S3 and WebDAV — though the captured pages give different figures for webhook availability. The workflow side stays thin: intake, follow-up and filing run as rules and OCR can precede extraction and approval, but we found no public information on a graphical workflow designer, on handover to ERP or DATEV connectors, or on the scope of the e-signature offer. 2 5 10 11
Search, retrieval & exit
Show reasoningHide reasoning
How this is scored
Finding documents again and taking them with you: full-text and metadata search, saved searches and mobile access, and whether documents, metadata, versions and audit trail can be exported in documented formats when the contract ends.
0 — Folder browsing only; no export beyond downloading single files.
3 — Full-text search exists, but no metadata filters, and bulk export is undocumented or only on request.
5 — Full-text and metadata search with filters and saved searches, mobile or web access, and bulk export of documents with their metadata (for example CSV or XML) documented.
8 — Search across versions and attachments with permissions respected, export of documents in original format with metadata, versions and audit trail in a documented structure, and an import path from other DMS or file shares named.
10 — The exit is designed in: a documented complete export with schema, export available self-service at any time, the post-termination retrieval window and data deletion stated, and archives stored in open formats so a successor system can take them over intact.
The GoBD Auditor
Search is strong: full text, OCR text and semantic search over embeddings at summary, page and paragraph level, saved searches and filters, all respecting workspace permissions, on web and mobile with voice. The exit is only half designed: bulk export of metadata as Excel, CSV, JSON or PDF with original files and OCR text is documented, but we found no public information on exporting versions and the audit trail together, on an export schema, or on the post-termination retrieval window and data deletion. 8 9 12 13
The Records Manager
Search is documented end to end: full text, OCR text and semantic modes with filters for workspace, document type, status, region and period, saved searches, mobile and voice search, results restricted to workspaces the user is authorized for, and every hit showing its relevance and source. Bulk export of metadata as Excel, CSV, JSON or PDF, optionally with original files and OCR text, is documented, and existing archives come in through watched folders, the Data Importer or the REST API. We found no public information on searching across versions and attachments, on an export that carries versions and the audit trail together, or on the exit terms after termination. 3 8 9 12 13
The IT Integrator
Search runs as full text, OCR text, semantic over embeddings at summary, page and paragraph level, and hybrid modes, with filters for workspace, document type, status, region and period, saved searches, permission-aware results and a mobile app with voice search. Migration in both directions works without the vendor's services team — watched folders, a Data Importer over SFTP, S3, WebDAV and ZIP, or the REST API in; metadata exports as Excel, CSV, JSON or PDF with optional originals and OCR text out — though we found no public information on an export that includes versions and the audit trail, on a documented export schema, or on the post-termination retrieval window. 8 9 12 13
The Mittelstand Owner
Full-text, OCR and semantic search with filters for workspace, document type, status and period, saved searches, a mobile app and permission-scoped results are all documented, and metadata goes out as Excel, CSV, JSON or PDF together with the original files and OCR text. We found no public information on searching across versions, on exporting versions and the audit trail in one documented structure, or on the retrieval window after the contract ends. 8 9 12 13
The Data Protection Officer
Search spans full text, OCR text and semantics with saved searches, filters for workspace, document type and period, permissions respected, and a mobile app with voice input; metadata of selected documents exports as Excel, CSV, JSON or PDF with originals and OCR text, and an import path via SFTP, S3, WebDAV or ZIP is named. For the exit I found no public information on exporting versions and the audit trail in a documented structure, on a self-service complete export, or on the post-termination retrieval window and data deletion. 8 9 12 13
The Skeptic
Search is the strongest part — full text, OCR text and semantic search over summary, page and paragraph embeddings, hybrid and exact modes, filters, saved searches, permission-scoped results, mobile access and instant indexing — and bulk export as Excel, CSV, JSON or PDF with originals and OCR text is documented, alongside named import paths. The exit is where it stops: we found no public information on exporting versions or the audit trail in a documented structure, on a complete-export schema, or on the post-termination retrieval window. 8 9 12 13
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and its owner are, where documents and their metadata are stored and processed in the cloud edition, and who the subprocessors are — including any AI provider that reads document content. Independently sourced by the sovereignty pipeline.
0 — Non-EU contracting entity, no statement on where documents are stored, and subprocessors unnamed.
3 — An EU entity contracts, but the cloud edition runs on a non-EU-controlled hyperscaler without a stated safeguard, or the subprocessor list is absent.
5 — EU contracting entity and EU data centres stated for the cloud edition, with a DPA, but significant parts of the chain (hosting, AI processing, support) are non-EU-controlled without a stated safeguard.
8 — EU entity, documents and metadata stored in named EU data centres, subprocessor list with locations published, AI processing location disclosed, an on-premises or private-cloud option offered, and certifications (ISO 27001, BSI C5) published.
10 — Sovereign end to end and evidenced: European ownership, EU entity, every processing location and subprocessor European, customer-controlled keys or on-premises operation available, and certifications with their scope published.
The GoBD Auditor
The contracting party is a Spanish entity, processing and storage are stated to run in the vendor's own EU data center with no US cloud, AI processing included, and ISO 27001 is claimed as certified. The data center carries no name beyond "EU", we found no public information on a subprocessor list, on the ownership behind the entity, or on a data processing agreement, and a US office in San Jose handles sales and support. 5 11 13
The Records Manager
The contracting party for all services worldwide is a Spanish entity, and the captured pages state that processing and storage, AI included, run in the vendor's own EU data center with no US cloud, while files can stay on your own NAS or server through a storage mount. We found no public information on the owner, a subprocessor list with locations, or a data processing agreement; index and metadata stay in the data center even with files on your own storage, and a US office in San Jose handles sales and support. ISO 27001 is stated as certified and SOC 2 Type 2 as in preparation. 5 8 9 11 13
The IT Integrator
The contracting party worldwide is a Spanish S.L.U. in Pamplona, and the vendor states that processing, storage, index and embeddings run in its own EU data center with no US cloud, that OCR and analysis run on own GPU hardware with data deleted after completion, and that files can stay on your own NAS — though even then the index and metadata remain in the vendor's data center. We found no public information on the ownership behind the entity, a subprocessor list, a data processing agreement or the scope of the ISO 27001 certificate, and a San Jose office is listed for sales and support. 5 8 9 11 13
The Mittelstand Owner
The contracting party is a Spanish company, processing and storage run in the vendor's own EU data center with no US cloud, and ISO 27001 certification is claimed. We found no public information on the ownership behind the Spanish entity, on a published subprocessor list, or on where the Claude, ChatGPT, Grok and Le Chat assistants run that can search my documents — and even with files on my own NAS, index and metadata stay in the data center. 2 5 8 11 13
The Data Protection Officer
The contracting party is a Spanish S.L.U., capture, storage, index and embeddings are stated to run in the vendor's own EU data center with no US cloud, and ISO 27001 certification is published — which answers where personnel files and customer contracts are read. I found no public information on the subprocessors, on a data processing agreement, on a named data-centre site or on the company's ownership. External AI assistants — Claude, ChatGPT, Grok and Le Chat — are offered direct archive search with nothing published about that processing chain, while a US office in San Jose handles sales and support. 2 5 8 11 13
The Skeptic
A Spanish limited-liability company contracts, processing and storage are stated to run in the vendor's own EU data center with no US cloud and OCR on RAM disk with deletion after completion. The holes decide the score: the archive is exposed as a search surface to Claude, ChatGPT, Grok and Le Chat, a US office in San Jose handles sales and support, and we found no public information on ownership, a subprocessor list with locations, a data processing agreement, or the scope of the ISO 27001 certificate. 5 8 11 12 13
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the cost of a given number of users, storage and modules — including cloud versus on-premises licensing, maintenance, implementation partner fees and price increases — from public pages alone.
0 — No public prices at all; every quote comes from sales or a partner.
3 — A "from" price or a single edition priced, but modules, storage, maintenance and partner implementation are unstated — the real cost is unknowable.
5 — Editions priced per user or per month, but at least one commonly needed cost (storage, archiving or workflow module, maintenance percentage, onboarding) is missing or "on request".
8 — Every edition and module priced publicly, storage limits and overage stated, on-premises licence and maintenance terms given, and contract term and notice period published.
10 — Complete cost computability: a configurator or price list covering users, modules, storage and deployment model, partner implementation priced or bounded, and price-increase terms on a public page.
The GoBD Auditor
Unit prices for OCR pages are public — $0.01, $0.02 and $0.03 per page by mode, the same in app, API and MCP, with the API billed in credits — but the captured pages give no prices for the Basic, Premium, Ultra or Corporate plans and no information on the credit price, storage, maintenance, contract term or implementation. A buyer cannot compute what ten users cost. 5 7 12
The Records Manager
The only public figures are per processed page — basic at $0.01, premium at $0.02, ultra at $0.03 — with API use billed in credits and a free trial that needs no credit card. Plan names such as Basic, Premium, Ultra and Corporate appear with what each unlocks for search and the Audit Center, but we found no public information on what any plan costs per user or per month, or on storage, maintenance, contract term and implementation. A buyer cannot compute the cost of a given team from these pages. 5 7 12 13
The IT Integrator
The only public prices are per-page unit prices — "basic · Text $0.01 per page", "premium · Grid + codes $0.02 per page", "ultra · Complete $0.03 per page" — alongside "No subscription, no base fee" for processing and a free trial without credit card. Plan names such as Basic, Premium, Ultra and Corporate appear, with the Audit Center overview gated from Corporate and the API billed in credits, but we found no public information on what a plan or a credit costs, on storage limits, or on user pricing — the total cost for a given team cannot be computed from the public pages. 5 7 9 12
The Mittelstand Owner
Only unit prices are public: OCR at "$0.01 per page" for basic, "$0.02 per page" for premium and "$0.03 per page" for ultra, and an API billed in credits whose price I could not find. We found no public information on what the Basic, Premium, Ultra or Corporate plans cost per user or per month, on storage, contract term or notice period — I cannot put a budget on the table before the partner visit. 5 7 12
The Data Protection Officer
Public prices cover only processing units: OCR at $0.01 per page for basic, $0.02 for premium and $0.03 for ultra, and an API billed in credits — plans named Basic, Premium, Ultra and Corporate appear with search depth tied to them but with no per-user or per-month price. For storage, maintenance, contract term, notice period and price increases I found no public information, so the cost of a given team cannot be computed from the public pages. 5 7 12
The Skeptic
The only hard numbers we found are per-page OCR prices — "$0.01 per page" for basic and "$0.03 per page" for ultra — and a credit-billed API on every plan, with plan names such as Basic, Premium, Ultra and Corporate appearing only as feature gates. We found no public information on subscription prices per user or month, storage costs, maintenance, contract term or notice period, so the cost of a given deployment is not computable from public pages. 5 7 12
European sovereignty — proven facts
0 of 4 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined | — | uncited Report an error |
|---|---|---|---|
| Ownership | Not determined | — | uncited Report an error |
| Data residency | Not determined ⚠ unverified | — | uncited Report an error |
| Subprocessors | Not determined ⚠ unverified | — | uncited Report an error |
Questions about PaperOffice
Is PaperOffice European?
Not determined: the vendor’s pages as captured do not say where PaperOffice is based.
Where does PaperOffice store data?
The default storage location for customer data is not stated on the vendor’s pages as of 20 Oct 2026. The vendor’s pages mention the EU as hosting location, per the vendor’s page captured 20 Oct 2026.
Does PaperOffice have a free plan?
Not stated on the vendor’s pages as of 20 Oct 2026.
What are the best alternatives to PaperOffice?
As of 21 Oct 2026, the panel rates AMAGNO (3/5), Doxis (3/5) and EASY Archive (2.5/5) highest among the other 17 Document Management (DMS) products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is AMAGNO (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: PaperOffice alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 20 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data residency, Subprocessors. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 31 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 13 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 9 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 hosting facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 pricing fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 subprocessors fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
Sources (13)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor page www.paperoffice.com Checked 20 Oct 2026 Details →
- 2 Legal notice — found from the homepage paperoffice.ai Checked 20 Oct 2026 Details →
- 3 Privacy policy — found from the homepage paperoffice.ai Checked 20 Oct 2026 Details →
- 4 Security / trust page — found from the homepage paperoffice.ai Checked 20 Oct 2026 Details →
- 5 Capture, OCR & indexing — found from sitemap paperoffice.ai Checked 20 Oct 2026 Details →
- 6 Capture, OCR & indexing — found from sitemap paperoffice.ai Checked 20 Oct 2026 Details →
- 7 Versioning, permissions & audit trail — found from sitemap paperoffice.ai Checked 20 Oct 2026 Details →
- 8 Audit-proof archiving & retention — found from sitemap paperoffice.ai Checked 20 Oct 2026 Details →
- 9 Audit-proof archiving & retention — found from sitemap paperoffice.ai Checked 20 Oct 2026 Details →
- 10 Document workflows & integrations — found from sitemap paperoffice.ai Checked 20 Oct 2026 Details →
- 11 Document workflows & integrations — found from sitemap paperoffice.ai Checked 20 Oct 2026 Details →
- 12 Search, retrieval & exit — found from sitemap paperoffice.ai Checked 20 Oct 2026 Details →
- 13 Search, retrieval & exit — found from sitemap paperoffice.ai Checked 20 Oct 2026 Details →