PapelShip
Get started
Get startedSign in

Security

Security built into every sale and every license.

PapelShip protects merchants and their customers at checkout, inside the software they sell and in the accounts they run it from. This page explains how, and what we ask of you in return.

Report a vulnerabilityPrivacy Policy

Payment attempt

Scoring

Risk score

4 / 100

Threshold 60
CountryGermany
IP address91.64.•.•
VPN or proxyNot detected
Signals0 of 5

Order PS-20418

Awaiting payment
PaymentviaStripe
Card numberNot stored by PapelShip
LicensePAPEL-7F3K-91XA
DeliveryWaiting

License created automatically when the order is paid

DemoApp.exe

Not started
  • Key exchange · X25519
  • Server signature · Ed25519
  • License active
  • Bound to this HWID

Decided on PapelShip's servers

Our approach

Protection sits where it can't be tampered with. Decisions run on our servers, and you set the rules.

  1. 01

    Decided on the server

    License checks, bans and risk scores are worked out on PapelShip, where a patched binary can't change the answer.

  2. 02

    Card data stays with processors

    Card payments go through third-party processors such as Stripe, PayPal and WeePay. PapelShip doesn't store full card numbers.

  3. 03

    Access you can scope

    Staff links, reseller accounts and API keys carry only the permissions you grant, with the limits and expiry you set.

  4. 04

    Your rules, your call

    Fraud rules, tamper responses and ban thresholds are yours to set. What gets blocked is always your decision.

Data protection

Your data, encrypted in transit and at rest.

Technical and organisational measures protect the information on PapelShip. The Privacy Policy sets out what we collect, why, and who processes it.

Read the Privacy Policy
  • TLS encryption for data in transit and AES-256 encryption for data at rest.
  • Role-based access controls and continuous monitoring against unauthorized access.
  • We don't sell personal information.
  • Ask for a copy, a correction or deletion of your data at [email protected].

What we hold, and how

Privacy Policy
In transit · TLSAt rest · AES-256Role-based access

  • Account details

    Name, email, company

    On PapelShipEncrypted at rest

  • Card payments

    Stripe, PayPal, WeePay

    With the processorFull number not stored

  • License data

    Keys, HWID, validation events

    On PapelShipEncrypted at rest

  • Usage data

    Device, IP address, pages viewed

    On PapelShipEncrypted at rest

Checkout and fraud

Risky payments are stopped before an order exists.

Fraud protection is on by default. Every attempt that reaches your checkout is scored from IP, email, device and behavioural signals, and your rules decide what happens next.

How fraud protection works
  • A 0–100 risk score from repeated attempts, one email on several IPs or devices, many countries and your blacklist.
  • VPNs, proxies, Tor, hosting networks, anonymisers and iCloud Private Relay are flagged.
  • Rules by IP, email, device fingerprint and invoice count, each set to block, notify or only log.
  • Per product: block VPN and proxy purchases, cap purchases per customer or ask for a verification form.

Fraud

Same device · 4 attempts
OverviewRulesEventsBans
  • j•••@mail.com18Allowed
  • k•••@mail.com41Allowed
  • m•••@mail.com66Notified
  • r•••@mail.com88Blocked

Rule

Watching
Condition
More than 3 invoices from one device
Action
Block, then ban the IP and browser for 24 h

Stopped before an order was created.

Crypto wallet

100% non-custodial, direct to your wallet.

Crypto payments settle directly into your own non-custodial wallet. PapelShip never holds or custodies user funds; keeping the wallet and its private keys safe is entirely up to you.

Crypto payments
  • Strictly non-custodial architecture: PapelShip never holds, stores or custodies your crypto assets.
  • Wallet-to-wallet settlement: Customer payments route directly to addresses you control.
  • For Bitcoin and Litecoin, connect your Electrum or Sparrow xpub. Your private keys never leave your hands.
  • Address allowlists and real-time on-chain verification ensure payments arrive safely at your intended destination.

Transfer

Awaiting code
CoinUSDT · TRC-20
Amount1,250.00 USDT
ToOffice wallet
AddressTQ5m…8vRw

One-time code

418027

Valid only for this address, this amount and this coin.

Address book

Whitelist on

  • Office wallet

    TQ5m…8vRw
    Active

  • Cold storage

    bc1q…7kd2
    Active

  • New address

    0x8f…31c4
    Active in 24 h

Funds can only go to whitelisted addresses.

Software protection

The license check happens on our servers, not in your binary.

qPapel Auth decides whether a key is valid, active and bound to the right hardware. Every reply is signed, so a fake server can't answer in our place.

Genuine serverProxy in the middle
  • key exchangeX25519ok
  • server signatureEd25519verified
  • channelChaCha20-Poly1305encrypted
  • licensePAPEL-7F3K-91XAactive
  • hardware9F2C·A41E·07BDmatch
  • session key4c1e…rotated
Every message encrypted and signed.Session running
  • X25519 key exchange, Ed25519 server signatures and ChaCha20-Poly1305 encryption on every message.
  • Session keys refresh with every session, and a session can be locked to one IP address.
  • Keys bind to the buyer's hardware. Another PC with the same key is refused and logged.
  • Strings and files stay on the server and reach only a session with a valid license.
  • Authentication endpoints are rate limited, with automatic throttling for abusive traffic.

Tamper detection and qPAnalyzer watch the machine the software runs on, from debuggers and inline hooks to renamed and custom cracking tools.

qPapel AuthqPAnalyzer

Accounts and access

Give access without giving away your account.

Admin sign-ins are protected with two-factor authentication. Everyone else gets only the access you grant, for as long as you choose.

  • Teammates get their own permissions to view, add, edit and delete.
  • Staff links carry scopes, usage limits and an expiry, and stop working the moment you disable them.
  • API keys with read and write permissions per resource, expiry dates and IP whitelists.
  • Webhooks are signed with HMAC-SHA256, so you can check every event came from PapelShip.
  • AI tools connect over MCP with OAuth, and their changes wait as drafts until you publish.

Admin sign-in

Two-factor on
PasswordTwo-factor codeBoth needed to reach the dashboard

API key · Order sync

Active
ResourceReadWrite
  • Orders
  • Products
  • Customers
  • Licenses
Expires31 Jan 2027
IP whitelist203.0.113.24
Calls1,284 · 0 errors
WebhooksSigned · HMAC-SHA256

Staff link · Support

Active

Scopes

View keysReset HWIDAdd time
ProductsDemoApp
Uses12 / 50
ExpiresIn 30 days
PasswordRequired
Link enabled

Shared responsibility

Some of security is ours. Some of it is yours. Here is who looks after what.

What PapelShip does

  • Encrypt data in transit and at rest, and limit who can reach it.
  • Route card payments through third-party processors and never store full card numbers.
  • Score payment attempts and apply the rules you set.
  • Validate licenses on our servers and rate limit the authentication endpoints.
  • Review abuse and security reports and act on them.

What we ask of you

  • Keep your login details and API secret keys confidential.
  • Tell us at [email protected] straight away if you notice unauthorized access.
  • Keep your crypto wallet and its private keys secure.
  • Remove staff and reseller access as soon as someone no longer needs it.
  • Collect only the data your software needs through HWID binding, Remote Settings and analytics.
Read the Terms of Service

Report a vulnerability

Found a security issue? Tell us first.

Follow the Vulnerability Disclosure Policy, act in good faith and give us reasonable time to respond, and we won't pursue legal action over your research. We'll keep you informed until the issue is resolved.

In scope

  • papelship.com and the dashboard
  • Hosted checkout and stores on mypapel.com
  • The API, webhooks and qPapel authentication servers
  • The qPapel C++ and C# SDKs

We don't currently run a paid bug bounty programme. To report a scam store or a leaked license instead, use Report abuse.

Read the policy

New message

Draft
To[email protected]
SubjectSecurity report
  • The issue and its potential impact
  • Affected URL, endpoint, SDK version or component
  • Steps to reproduce, with a proof of concept
  • How you would like to be credited
  1. Acknowledged
  2. Investigating
  3. Resolved

Questions, answered

More on accounts, data and protection in the help center.

Visit the help center

No. Card payments are processed by third-party processors such as Stripe, PayPal and WeePay, and PapelShip doesn't store full card numbers. What we do keep is set out in the Privacy Policy.

No. PapelShip is strictly non-custodial. Crypto payments go directly to your own wallet on-chain. PapelShip never holds, stores or custodies crypto balances; keeping the wallet and its private keys secure is entirely your responsibility.

On PapelShip's servers. qPapel Auth decides there whether a key is valid, active and bound to the right hardware, and session keys refresh with every session. Your binary is also hardened against debugging and memory dumping. See qPapel Auth.

Security signals about the environment your application runs in, screenshots of flagged windows, a desktop capture if you turn it on in Remote Settings, and the binaries a scan flags. Everything is shown in your dashboard.

Email [email protected] straight away. Staff links stop working the moment you disable them, so switch off any you don't recognise.

Send a request through the contact form or write to [email protected]. We may ask you to confirm your identity first.

Not a paid one. We welcome reports under the Vulnerability Disclosure Policy, and you can tell us how you would like to be credited.

Use Report abuse. Choose a category, add the URL and any evidence, and our Trust & Safety team will review it.