Security designed into the foundation.

Access to ODVIX Paper Labs accounts is gated by authenticated sign-in. Email verification is required on account creation, and server-enforced authorization boundaries scope every request to the account’s own forms, templates, and documents.

Passwords are hashed on the server before persistence; plaintext passwords are never stored or logged. The password-reset flow issues single-use, expiring tokens delivered to the verified account email.

Sessions and API tokens are issued and revoked by the backend, expire after a bounded lifetime, and are cleared on logout. Cookie-based flows use CSRF protection and appropriate cookie attributes for the deployed environment.

Every workspace is scoped to its owning account. Application logic enforces access boundaries on read and write paths so users can only reach the resources their account owns. Administrative access to production systems follows least-privilege principles.

Application secrets and credentials are separated by environment and are not checked into source control. Database and storage access is scoped to the application service account. The codebase is type-checked and dependency changes go through code review before reaching production.

Public traffic to ODVIX Paper Labs is served over HTTPS/TLS. API requests and browser sessions use secure transport between the client and our servers.

When payments are enabled for your account, card and billing details are handled by the selected payment processor and are not stored on ODVIX Paper Labs servers. We receive only the metadata necessary to associate a charge with your account.

Operational logs are captured to support reliability, debugging, and abuse response. Access to logs is limited to authorized engineering staff.

We welcome reports from security researchers. Please send reports to support@odvixpaperlabs.com with the subject line “Security Report.”

ODVIX Paper Labs provides platform-level security controls. Customers remain responsible for account access hygiene, the data they choose to submit through forms and APIs, and the downstream distribution of generated documents.