"AI that brings out the best in you, from first idea to final draft"
Paperpal is an AI-powered academic writing tool for researchers, students, authors, and scientific teams.
It combines language correction, academic paraphrasing, research and citation assistance, PDF chat, plagiarism checking, and other pre-submission features on one platform. The provider explicitly positions Paperpal as a secure all-in-one solution for scientific writing.
Paperpal
AI that brings out the best in you, from first idea to final draft
Location: Singapore ⓘ Cactus Communications Services Pte Ltd, 20 McCallum Street, #19-01, Tokio Marine Centre, Singapore 069046.
Institutional Plans Individual solutions for universities, institutions, students, or employees.
Multi-year Plan One-time longer-term option for users who want to book long-term.
Target audience
Paperpal is primarily aimed at researchers, students, professors, academic authors, journal submitters, medical writers, and academic editing services. Small research groups, institutes, and publishers are also part of the target audience. However, the tool is less suitable for general business text production without an academic context.
Outstanding features
Particularly noteworthy are the academic language enhancement, scientific paraphrasing, “Research & Cite” with access to 250M+ research articles, support for 10,000+ citation styles, and chat with PDFs. In addition, there are integrations with Word, Google Docs, Chrome, Web, and Overleaf, allowing the tool to be embedded directly into existing academic writing workflows.
Main use cases
Paperpal is used for manuscripts, term papers, dissertations, journal submissions, pre-submission checks, literature work, citation assistance, academic rewording, and linguistic fine-tuning. Through the combination of research, correction, and submission-oriented quality checks, it is more of an academic work companion than a generic AI text assistant.
Usage & notes
Paperpal can be used in the browser and in familiar writing environments such as Word or Overleaf. The free version is solid for initial testing, but quickly reaches its limits due to monthly and daily caps. For organizations with strict data protection requirements, it is important that although the provider publishes privacy and security statements, hosting is not EU-exclusive and contractual details should be reviewed before a productive rollout.
| Target audience | Assessment |
|---|---|
| Students | Highly suitable – for academic texts, grammar, style, paraphrasing, citations, and PDF comprehension. |
| Researchers / Scientists | Highly suitable – for manuscripts, journal checks, plagiarism checks, AI detector, literature research, and linguistic quality. |
| Teachers / Universities | Highly suitable – for academic writing support, feedback, institutional use, and research communication. |
| Freelancers / Specialist authors | Suitable – for specialist texts, white papers, reports, and English-language quality assurance. |
| Companies in general | Conditionally suitable – strong for science-related texts, but less broad for marketing, sales, or internal workflows than Grammarly, DeepL, or ChatGPT. |
Hosting & Data
1) On-prem / local hosting
Meaning: The company operates the solution on its own hardware or within its own infrastructure. In the strictest sense, not only the application runs locally, but ideally the model as well.
2) Private cloud / data center
Meaning: The solution runs in a dedicated or more clearly separated cloud environment, often with a hosting provider or hyperscaler, but in a German data center or in a particularly controlled environment.
3) EU SaaS / managed
Meaning: The provider operates the solution itself as a service. The company uses the tool as a ready-made cloud service, ideally with EU data residency.
4) Hybrid
Meaning: One part of the processing remains internal / local / in a private cloud, while another part runs in an external cloud or EU SaaS.
5) AVV / DPA
Meaning: This is the data processing agreement or Data Processing Addendum. It governs that the provider processes personal data on behalf of the customer and is bound by the customer's instructions.
6) No training
Meaning: The provider does not use your prompts, uploads, attachments, chat histories, or outputs for training or improving the general model — ideally excluded by contract.
7) Open-source / transparency path
Meaning: There is a path toward greater technical transparency and sovereignty, for example through:
- open models
- documented components
- self-hostable parts
- traceable architecture
- export / switching options
| On-prem / local hosting | ❓ |
| Private cloud / data center | ❓ |
| EU SaaS / Managed | ⚠️ |
| Hybrid | ❓ |
| DPA / AVV | ❓ |
| No training on customer data | ✅ |
| Open source / transparency path | ❓ |
On-Prem / local hosting: indirect / not available
No on-premise, local, or self-hostable deployment was described on the website.
Private cloud / data center: unclear
Secured data centers and cloud infrastructure are mentioned, but no dedicated or isolated private cloud option for customers and no EU/EEA-specific controlled environment.
EU SaaS / managed: partial
Paperpal is described as a hosted cloud service. However, key information for the EU/EEA regarding EU data residency or EU/EEA data centers is missing from the website.
Hybrid: indirect / not available
No hybrid model was described on the website in which processing takes place partly locally or in the customer's own environment and partly externally.
DPA / DPA: unclear
A publicly discoverable DPA/AVV or Data Processing Addendum page was not found on the website.
No training: covered
The website and the Help Center explicitly state several times that user data, documents, inputs, prompts, and work are not used to train the AI.
Open source / transparency path: indirect / not available
No open-source components, open models, self-hostable parts, or any other transparency path of this kind were mentioned on the website.
Data processing
Paperpal describes centrally hosted cloud processing with encrypted transmission and storage, secure SOC1-certified data centers, and cloud services such as Amazon Cloud Storage or AWS infrastructure. Users can delete files, and retention periods are specified for certain types of data. However, for the EU/EEA, specific information on data residency, data transfers, and contractual data protection mechanisms is missing.
Conclusion
For EU/EEA users, the website primarily indicates a standardized SaaS operation with good general security assurances. Positive aspects include certifications and the clear statement 'no AI training with user data'. However, the decisive evidence for a robust European GDPR approval is missing, particularly regarding EU data residency, server locations, DPA/AVV, and subprocessors. Therefore, the overall situation must be classified as unclear.
Sources
- https://paperpal.com/data-security
- https://paperpal.com/paperpal-for-universities
- https://support.paperpal.com/support/solutions/articles/3000126439-does-paperpal-use-my-data-
- https://support.paperpal.com/support/solutions/articles/3000123164-will-my-data-be-used-for-training-paperpal-ai-
- https://support.paperpal.com/support/solutions/articles/3000123165-how-secure-is-my-research-on-the-paperpal-platform-
- https://support.paperpal.com/support/solutions/articles/3000126436-how-secure-is-paperpal-should-i-be-concerned-about-my-manuscripts-
- https://support.paperpal.com/support/solutions/articles/3000126437-how-long-is-data-stored-by-paperpal-can-i-delete-my-data-
- https://support.paperpal.com/support/solutions/articles/3000130084-how-secure-is-my-work-does-paperpal-save-my-chat-pdf-data-
- https://support.paperpal.com/support/solutions/articles/3000130071-when-i-use-paperpal-for-overleaf-will-paperpal-use-my-work-to-train-its-ai-
- https://cdn.paperpal.com/assets/pdf/iso-security.pdf
| On-prem / local hosting | ❓ |
| Private cloud / data center | ❓ |
| EU SaaS / Managed | ⚠️ |
| Hybrid | ❓ |
| DPA / AVV | ❓ |
| No training on customer data | ✅ |
| Open source / transparency path | ❓ |
On-Prem / local hosting: indirect / not available
No on-premise, local, or self-hostable deployment was described on the website.
Private cloud / data center: unclear
Secured data centers and cloud infrastructure are mentioned, but no dedicated or isolated private cloud option for customers and no EU/EEA-specific controlled environment.
EU SaaS / managed: partial
Paperpal is described as a hosted cloud service. However, key information for the EU/EEA regarding EU data residency or EU/EEA data centers is missing from the website.
Hybrid: indirect / not available
No hybrid model was described on the website in which processing takes place partly locally or in the customer's own environment and partly externally.
DPA / DPA: unclear
A publicly discoverable DPA/AVV or Data Processing Addendum page was not found on the website.
No training: covered
The website and the Help Center explicitly state several times that user data, documents, inputs, prompts, and work are not used to train the AI.
Open source / transparency path: indirect / not available
No open-source components, open models, self-hostable parts, or any other transparency path of this kind were mentioned on the website.
Data processing
Paperpal describes centrally hosted cloud processing with encrypted transmission and storage, secure SOC1-certified data centers, and cloud services such as Amazon Cloud Storage or AWS infrastructure. Users can delete files, and retention periods are specified for certain types of data. However, for the EU/EEA, specific information on data residency, data transfers, and contractual data protection mechanisms is missing.
Conclusion
For EU/EEA users, the website primarily indicates a standardized SaaS operation with good general security assurances. Positive aspects include certifications and the clear statement 'no AI training with user data'. However, the decisive evidence for a robust European GDPR approval is missing, particularly regarding EU data residency, server locations, DPA/AVV, and subprocessors. Therefore, the overall situation must be classified as unclear.
Sources
- https://paperpal.com/data-security
- https://paperpal.com/paperpal-for-universities
- https://support.paperpal.com/support/solutions/articles/3000126439-does-paperpal-use-my-data-
- https://support.paperpal.com/support/solutions/articles/3000123164-will-my-data-be-used-for-training-paperpal-ai-
- https://support.paperpal.com/support/solutions/articles/3000123165-how-secure-is-my-research-on-the-paperpal-platform-
- https://support.paperpal.com/support/solutions/articles/3000126436-how-secure-is-paperpal-should-i-be-concerned-about-my-manuscripts-
- https://support.paperpal.com/support/solutions/articles/3000126437-how-long-is-data-stored-by-paperpal-can-i-delete-my-data-
- https://support.paperpal.com/support/solutions/articles/3000130084-how-secure-is-my-work-does-paperpal-save-my-chat-pdf-data-
- https://support.paperpal.com/support/solutions/articles/3000130071-when-i-use-paperpal-for-overleaf-will-paperpal-use-my-work-to-train-its-ai-
- https://cdn.paperpal.com/assets/pdf/iso-security.pdf
Strengths & weaknesses at a glance
| Strengths | Weaknesses |
|---|---|
| • Clear specialization in science and academic writing | • Clearly focused on academia and therefore less suitable for general business use cases |
| • Research and citation features based on a large literature database | • The free version is clearly limited in terms of corrections, AI usage, and PDF chat |
| • Integration with Word, Google Docs, Chrome, Web, and Overleaf | • Data hosting/backups are not exclusively in the EU, but are described as being, among other places, in Singapore, India, the USA, and Japan |
| • Public privacy statement: “We don't train AI models on your data” | • A clearly publicly accessible separate AVV/DPA page for self-serve customers was not apparent in the sources reviewed |
| • Security and compliance signals such as ISO/IEC 27001 processes and current Trust/Accessibility updates |
Reviews
0 reviews in total
There are no confirmed reviews for this tool yet.
Submit review
Your review will only become visible after email confirmation. This protects the portal against abuse.
Report review
Please select the reason why this review should be checked.
GDPR-compliant usage possible?
For users in the EU/EEA, the Paperpal website contains several positive statements about data protection and security, including references to GDPR compliance, ISO certification, and the statement that user data is not used to train the AI. However, for a robust GDPR assessment for the entire European area, the website lacks key, concretely verifiable information, in particular regarding EU/EEA data residency, specific server locations, a publicly available DPA/AVV, and a list of subprocessors. Therefore, GDPR-compliant use cannot be clearly demonstrated based on the website documentation.
Positive
Positive are the explicitly stated data protection and security measures: Paperpal describes itself as 'fully aligned' with GDPR, mentions ISO/IEC 27001 certification, refers to CSA STAR Level 1, states encrypted storage and transmission, and says that inputs, prompts, and documents are not used to train the AI.
Negative
Negative is that the website does not name any specifically identified EU/EEA data centers or countries. Likewise, no publicly accessible DPA/AVV, no list of subprocessors, and no clear statement regarding EU data residency, SCCs, or other mechanisms for data transfers within the EU/EEA were found on the website. On-premise, self-hosting, or private cloud options are also not indicated on the website.
Server location
The website mentions 'SSAE 18/SOC1-certified facilities', 'trusted globally', as well as Amazon Web Services/cloud infrastructure, but does not specify any concrete server location or any EU/EEA country. EU data residency is not stated on the website.
