{ "data": { "similar": [ { "grade": "C", "json": "https://www.anchorterminal.com/tools/tally.json", "name": "Tally", "score": 60.6, "shared": [ "forms.responses", "forms.webhooks", "forms.surveys", "forms.embed" ], "slug": "tally" }, { "grade": "C", "json": "https://www.anchorterminal.com/tools/typeform.json", "name": "Typeform", "score": 58.4, "shared": [ "forms.responses", "forms.webhooks", "forms.surveys", "forms.embed" ], "slug": "typeform" }, { "grade": "C", "json": "https://www.anchorterminal.com/tools/formbricks.json", "name": "Formbricks", "score": 57.7, "shared": [ "forms.surveys", "forms.responses", "forms.webhooks", "forms.embed" ], "slug": "formbricks" }, { "grade": "C", "json": "https://www.anchorterminal.com/tools/surveymonkey.json", "name": "SurveyMonkey", "score": 55.3, "shared": [ "forms.surveys", "forms.responses", "forms.webhooks", "forms.embed" ], "slug": "surveymonkey" }, { "grade": "D", "json": "https://www.anchorterminal.com/tools/fillout.json", "name": "Fillout", "score": 52.2, "shared": [ "forms.responses", "forms.webhooks", "forms.surveys", "forms.embed" ], "slug": "fillout" }, { "grade": "BB", "json": "https://www.anchorterminal.com/tools/google-forms.json", "name": "Google Forms API", "score": 70.8, "shared": [ "forms.responses", "forms.webhooks", "forms.surveys" ], "slug": "google-forms" } ], "tool": { "slug": "paperform", "name": "Paperform", "vendor": "Paperform Pty Ltd", "vendorUrl": "https://paperform.co", "kind": "http-api", "category": "forms", "summary": "Paperform is a form builder from Paperform Pty Ltd in Sydney, with e-signatures (Papersign) and workflow automation (Stepper) on the same subscription. Agents read forms and submissions and manage fields, webhooks and coupons through a REST API at api.paperform.co.", "url": "https://www.anchorterminal.com/tools/paperform", "markdownUrl": "https://www.anchorterminal.com/tools/paperform.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/paperform.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/paperform.json", "license": "Proprietary service under Paperform's General Terms and Conditions of Use", "transports": [ "http" ], "remoteUrl": "https://api.paperform.co/v1", "packages": [], "auth": "api-key", "authNotes": "Self-serve on a paid plan. A signed-in user creates an API key at paperform.co/account/developer and sends it as `Authorization: Bearer \u003ctoken\u003e`. The plan decides what the key can call. Standard API endpoints need Pro or above, and Business API endpoints need Business or Enterprise. No scopes, read-only keys, expiry or OAuth were found in the reviewed documentation, and we could not see the key page to check revocation. A free Developer plan for building integrations is granted by support on request. No app review or partner approval was found.", "pricing": "paid", "pricingNotes": "The API needs Pro ($49 a month billed annually, $59 month to month) or above, and form updates and webhook endpoints need Business ($124 or $149). The Free plan has no API access. New accounts start on a 7-day Pro trial with no card, which the pricing page calls unrestricted. We did not test whether API keys work during the trial. There is no sandbox. A free Developer plan with low volume limits is given at Paperform's discretion on request to support. API calls have no per-call price (checked 2026-10-08).", "priceSummary": "$49 / mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the API reference, the help centre or the pricing page (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://paperform.readme.io/reference/getting-started-1", "llmsTxt": "https://paperform.readme.io/llms.txt", "capabilities": [ "forms.responses", "forms.webhooks", "forms.surveys", "forms.embed" ], "tags": [ "official", "hosted", "api-key", "openapi", "llms-txt", "webhooks", "paid-plan", "closed-source", "status-page", "soc2", "e-signature" ], "lastRelease": "2026-09-16", "graded": true, "anchor": { "graded": true, "score": 56, "grade": "C", "agentReady": false, "rank": 496, "ranked": true, "rankOf": 722, "categoryRank": 5, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 60, "maintenance": 41, "payments": 25, "reliability": 83, "schema": 69, "security": 40, "transparency": 54 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 83, "points": 16.6, "reason": "Read with the hosted lines and scored on the REST API. paperform.statuspage.io lists the API as its own component with an incident history (20). The feed's latest incident is 22 March 2026, so the last 90 days are clean (30). The docs describe a per-minute limit and four headers and give no figure. A live unauthenticated response carried `x-ratelimit-limit: 60` (8 of 15). 429 handling is documented through `Retry-After` and `X-RateLimit-Reset`. No idempotency key or retry guidance for writes was found (10 of 15). An SLA is sold on Enterprise, and its terms are not published (5 of 10). The API is version 1.0.0 with no beta label (10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 69, "points": 11.21, "reason": "Each reference page has a Markdown copy that embeds its OpenAPI 3.0.2 definition, 61 operations in all. No single spec file was found (22 of 25). `llms.txt` on the docs site and on paperform.co, with Markdown pages (10). Descriptions are one sentence each plus the plan tier, with section pages for limits such as 1,000 options a field. They don't say when not to use an endpoint (10 of 20). 95 enums, a typed schema for each of 27 field types, `limit` capped at 100, and few required fields marked. Submission answers are loosely typed by key (12 of 15). 187 examples in the spec and an error schema with `error_type` on every operation. The 429 body is plain text (11 of 15). The version is in the path as `/v1`, and no changelog was found (4 of 15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 60, "points": 9.75, "reason": "Lists return 20 items by default and at most 100. There is no field selection, and a submission carries device and charge data with its answers (15 of 25). `limit`, `skip`, `after_id`, `before_id`, date filters, `sort` and a search on forms (18 of 20). Errors carry `error_type`, `message` and `details` with suggested actions, and 403 marks a plan or permission problem (15 of 20). No idempotency keys. Updates are PUT, and Paperform says deleted forms and submissions can be restored in the dashboard since May 2026 (5 of 20). Few required parameters and a form can be addressed by slug or ID. No official SDK was found, and an agent can't create a form (7 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 40, "points": 7, "reason": "One API key per account page, sent only in the `Authorization` header. No scopes, expiry or OAuth were found, and we couldn't see the key page to confirm revocation (15 of 30). No read-only key. The plan tier limits writes, Standard API keys can still delete submissions, and no endpoint deletes a form (5 of 20). Submissions are text written by respondents, and no prompt-injection guidance was found (2 of 15). Audit logging records views, exports and deletions of submission data including those made through the API, on Enterprise only (7 of 15). Paperform says it renewed SOC 2 Type II in March 2026 and passed a penetration test in December 2025. No security.txt, disclosure policy or bug bounty was found, and the Trust Centre could not be read (11 of 20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 25, "points": 3.13, "reason": "Read with the hosted rubric. No x402, MPP or L402 (0). Plan prices are public, from $49 a month billed annually for the plan that includes the API, with no per-call price (10). The Free plan has no API access. New accounts get a 7-day Pro trial with no card, and we didn't test API keys in it (15 of 20). A person signs up in a browser and creates the key, and the terms forbid creating accounts by automated means (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 41, "points": 3.59, "reason": "The latest dated product change is 16 September 2026, an update to spaces across Paperform, Papersign and Stepper (30). We found two dated product posts in the last 90 days (1 and 16 September 2026) and no changelog, so the line for three entries is not met (0). Closed service with live chat and email support, a yearly product retrospective and no public changelog or issue tracker (6 of 15). No official SDK and no entry in the official MCP registry (0). No packages to assess. The reference includes recent Papersign endpoints such as draft creation and signer links (5 of 10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 54, "points": 4.72, "note": "editorial 39, provenance 69", "reason": "Closed service under public terms last updated 24 September 2025, with California law, arbitration and a USD 100 liability cap (15). The privacy policy gives no retention periods, and the API docs and help centre give some (30 days for partial submissions, 7 days for open file links). The policy says Paperform is domiciled in the United States while its contact address is in New South Wales. The DPA page could not be read (14 of 30). No deprecation policy or dated API notices were found. Legacy plans are documented (2 of 20). Hosting is stated as AWS in the USA with EU and Australian regions on Enterprise. The sub-processor list sits in the Trust Centre, which our reader could not load (8 of 20)." } ], "assessment": { "date": "2026-10-08", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "Lists return 20 items by default and at most 100. There is no field selection, and a submission carries device and charge data with its answers (15 of 25). `limit`, `skip`, `after_id`, `before_id`, date filters, `sort` and a search on forms (18 of 20). Errors carry `error_type`, `message` and `details` with suggested actions, and 403 marks a plan or permission problem (15 of 20). No idempotency keys. Updates are PUT, and Paperform says deleted forms and submissions can be restored in the dashboard since May 2026 (5 of 20). Few required parameters and a form can be addressed by slug or ID. No official SDK was found, and an agent can't create a form (7 of 15).", "maintenance": "The latest dated product change is 16 September 2026, an update to spaces across Paperform, Papersign and Stepper (30). We found two dated product posts in the last 90 days (1 and 16 September 2026) and no changelog, so the line for three entries is not met (0). Closed service with live chat and email support, a yearly product retrospective and no public changelog or issue tracker (6 of 15). No official SDK and no entry in the official MCP registry (0). No packages to assess. The reference includes recent Papersign endpoints such as draft creation and signer links (5 of 10).", "payments": "Read with the hosted rubric. No x402, MPP or L402 (0). Plan prices are public, from $49 a month billed annually for the plan that includes the API, with no per-call price (10). The Free plan has no API access. New accounts get a 7-day Pro trial with no card, and we didn't test API keys in it (15 of 20). A person signs up in a browser and creates the key, and the terms forbid creating accounts by automated means (0).", "reliability": "Read with the hosted lines and scored on the REST API. paperform.statuspage.io lists the API as its own component with an incident history (20). The feed's latest incident is 22 March 2026, so the last 90 days are clean (30). The docs describe a per-minute limit and four headers and give no figure. A live unauthenticated response carried `x-ratelimit-limit: 60` (8 of 15). 429 handling is documented through `Retry-After` and `X-RateLimit-Reset`. No idempotency key or retry guidance for writes was found (10 of 15). An SLA is sold on Enterprise, and its terms are not published (5 of 10). The API is version 1.0.0 with no beta label (10).", "schema": "Each reference page has a Markdown copy that embeds its OpenAPI 3.0.2 definition, 61 operations in all. No single spec file was found (22 of 25). `llms.txt` on the docs site and on paperform.co, with Markdown pages (10). Descriptions are one sentence each plus the plan tier, with section pages for limits such as 1,000 options a field. They don't say when not to use an endpoint (10 of 20). 95 enums, a typed schema for each of 27 field types, `limit` capped at 100, and few required fields marked. Submission answers are loosely typed by key (12 of 15). 187 examples in the spec and an error schema with `error_type` on every operation. The 429 body is plain text (11 of 15). The version is in the path as `/v1`, and no changelog was found (4 of 15).", "security": "One API key per account page, sent only in the `Authorization` header. No scopes, expiry or OAuth were found, and we couldn't see the key page to confirm revocation (15 of 30). No read-only key. The plan tier limits writes, Standard API keys can still delete submissions, and no endpoint deletes a form (5 of 20). Submissions are text written by respondents, and no prompt-injection guidance was found (2 of 15). Audit logging records views, exports and deletions of submission data including those made through the API, on Enterprise only (7 of 15). Paperform says it renewed SOC 2 Type II in March 2026 and passed a penetration test in December 2025. No security.txt, disclosure policy or bug bounty was found, and the Trust Centre could not be read (11 of 20).", "transparency": "Closed service under public terms last updated 24 September 2025, with California law, arbitration and a USD 100 liability cap (15). The privacy policy gives no retention periods, and the API docs and help centre give some (30 days for partial submissions, 7 days for open file links). The policy says Paperform is domiciled in the United States while its contact address is in New South Wales. The DPA page could not be read (14 of 30). No deprecation policy or dated API notices were found. Legacy plans are documented (2 of 20). Hosting is stated as AWS in the USA with EU and Australian regions on Enterprise. The sub-processor list sits in the Trust Centre, which our reader could not load (8 of 20)." }, "sources": [ { "what": "API reference, getting started", "url": "https://paperform.readme.io/reference/getting-started-1", "seen": "2026-10-08" }, { "what": "API docs index (llms.txt)", "url": "https://paperform.readme.io/llms.txt", "seen": "2026-10-08" }, { "what": "listing submissions reference with OpenAPI definition", "url": "https://paperform.readme.io/reference/listformsubmissions.md", "seen": "2026-10-08" }, { "what": "update form reference", "url": "https://paperform.readme.io/reference/updateform.md", "seen": "2026-10-08" }, { "what": "create webhook reference", "url": "https://paperform.readme.io/reference/createformwebhook.md", "seen": "2026-10-08" }, { "what": "form fields section", "url": "https://paperform.readme.io/reference/form-fields-1.md", "seen": "2026-10-08" }, { "what": "partial submissions section", "url": "https://paperform.readme.io/reference/partial-submissions-1.md", "seen": "2026-10-08" }, { "what": "API endpoint (401 without a key, rate limit headers)", "url": "https://api.paperform.co/v1/forms", "seen": "2026-10-08" }, { "what": "API help article and plan tiers", "url": "https://paperform.co/help/articles/paperform-api/", "seen": "2026-10-08" }, { "what": "Developer plan help article", "url": "https://paperform.co/help/articles/developer-plan/", "seen": "2026-10-08" }, { "what": "webhooks help article", "url": "https://paperform.co/help/articles/how-to-use-webhooks/", "seen": "2026-10-08" }, { "what": "resending webhooks help article", "url": "https://paperform.co/help/articles/can-we-resend-integration-actions/", "seen": "2026-10-08" }, { "what": "pricing", "url": "https://paperform.co/pricing/", "seen": "2026-10-08" }, { "what": "site llms.txt", "url": "https://paperform.co/llms.txt", "seen": "2026-10-08" }, { "what": "status components", "url": "https://paperform.statuspage.io/api/v2/components.json", "seen": "2026-10-08" }, { "what": "status incidents", "url": "https://paperform.statuspage.io/api/v2/incidents.json", "seen": "2026-10-08" }, { "what": "general terms and conditions of use", "url": "https://paperform.co/terms/", "seen": "2026-10-08" }, { "what": "privacy policy", "url": "https://paperform.co/privacy/", "seen": "2026-10-08" }, { "what": "data processing agreement page (no text read)", "url": "https://paperform.co/data-processing-agreement/", "seen": "2026-10-08" }, { "what": "Trust Centre (no text read)", "url": "https://trust.paperform.co/", "seen": "2026-10-08" }, { "what": "security help article", "url": "https://paperform.co/help/articles/is-paperform-secure/", "seen": "2026-10-08" }, { "what": "SOC 2 help article", "url": "https://paperform.co/help/articles/is-paperform-soc-2-compliant/", "seen": "2026-10-08" }, { "what": "data hosting help article", "url": "https://paperform.co/help/articles/where-is-data-hosted/", "seen": "2026-10-08" }, { "what": "Enterprise plan help article", "url": "https://paperform.co/help/articles/what-is-paperforms-enterprise-plan/", "seen": "2026-10-08" }, { "what": "product retrospective, May 2025 to June 2026", "url": "https://paperform.co/blog/product-retro-2025-2026/", "seen": "2026-10-08" }, { "what": "unified workspaces post, updated 16 September 2026", "url": "https://paperform.co/blog/unified-workspaces/", "seen": "2026-10-08" }, { "what": "security.txt (404)", "url": "https://paperform.co/.well-known/security.txt", "seen": "2026-10-08" }, { "what": "API docs changelog (404)", "url": "https://paperform.readme.io/changelog", "seen": "2026-10-08" }, { "what": "official MCP registry search", "url": "https://registry.modelcontextprotocol.io/v0/servers?search=paperform\u0026limit=50", "seen": "2026-10-08" }, { "what": "domain registration (RDAP)", "url": "https://rdap.registry.co/co/domain/paperform.co", "seen": "2026-10-08" } ], "openQuestions": [ "unchecked: the Trust Centre at trust.paperform.co, including the sub-processor list and the SOC 2 report. The page is a Paperform form drawn by script and returned no text.", "unchecked: the data processing agreement at paperform.co/data-processing-agreement, drawn by script.", "unchecked: the API key page at paperform.co/account/developer, which needs sign-in. Whether keys can be revoked, rotated or held more than one at a time is not established.", "unchecked: whether API keys work during the 7-day Pro trial. The pricing page calls the trial unrestricted and we did not create an account.", "unchecked: the `PUT /translations/{id}` reference page, which returned an error page. The other 60 definitions were read.", "unchecked: NVD and other advisory databases for Paperform.", "The rate limit figure of 60 a minute comes from one unauthenticated response. The limit for an authenticated key may differ by plan and is not published.", "The terms name the company only as Paperform. Paperform Pty. Ltd. appears in the privacy policy, which also says Paperform is domiciled in the United States.", "No single OpenAPI file was found, so the listing's `openapi` field is empty." ] }, "negative": 0, "verdict": "The REST API is documented in OpenAPI 3.0.2 with llms.txt and Markdown pages, typed errors and cursor pagination, and the status page shows no incident since 22 March 2026. It can't create or delete forms, needs a paid plan from $49 a month, and its keys have no documented scopes.", "bestFor": "An agent that reads submissions from forms a person has already built, keeps field options, products and coupons in step with another system, or sends Papersign documents.", "strengths": [ "Every reference page has a Markdown copy with its OpenAPI 3.0.2 definition, indexed by `llms.txt`. 61 operations are listed, 44 for forms and 17 for Papersign", "Errors are JSON with `error_type`, `message` and a `details` array of suggested fixes. 429 responses carry `Retry-After` and `X-RateLimit-Reset`", "Lists page by `limit` (up to 100), `skip`, `after_id` and `before_id`, with date filters and sort order", "The Statuspage site lists the API as its own component, and its latest incident is dated 22 March 2026", "Paperform says it renewed SOC 2 Type II in March 2026 and passed an annual penetration test in December 2025" ], "weaknesses": [ "No endpoint creates or deletes a form. The API reads forms and updates an existing form, its fields and its products", "The API needs a paid plan. Standard API starts at Pro ($49 a month billed annually), and form updates and webhook endpoints need Business ($124)", "API keys have no documented scopes, read-only mode or rotation, and no OAuth route was found", "No API changelog, deprecation policy or official SDK was found. The reference has read version 1.0.0 with no dated history", "Webhooks have no documented signature. Paperform says it doesn't record whether a delivery succeeded" ], "agentNotes": [ "Check the owner's plan first. Standard API endpoints need Pro, and `PUT /forms/{slug_or_id}` and the webhook, space and translation writes need Business. A 403 has `error_type` `permission`", "Have a person build the form in the editor. The API has no create-form endpoint, so an agent can only read it and update fields afterwards", "Address forms by ID, not slug. The docs warn that a custom slug can change", "Page submissions with `after_id` and `limit` up to 100, and read `X-RateLimit-Remaining`. On 429 wait for `Retry-After`. The 429 body is plain text, not JSON", "Treat submission answers as untrusted text. Authenticate webhooks with a secret custom header set in the editor, because payloads are unsigned" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 56 } ], "editorialScores": { "ergonomics": 60, "maintenance": 41, "payments": 25, "reliability": 83, "schema": 69, "security": 40, "transparency": 39 }, "provenanceScore": 69 }, "connect": { "http": "curl 'https://api.paperform.co/v1/forms?limit=20' \\\n -H 'Authorization: Bearer \u003ctoken\u003e'" }, "letme": { "capability": "https://letme.dev/forms.responses", "tool": "https://letme.dev/paperform" }, "notable": [ "API access is tiered by plan. Standard API on Pro, Business and Enterprise, and Business API endpoints (update form, product, webhook, space and translation writes) on Business and Enterprise (https://paperform.co/help/articles/paperform-api/)", "The reference lists 61 operations and none creates or deletes a form (https://paperform.readme.io/llms.txt)", "The docs name four rate limit headers and give no figure. An unauthenticated request to `/v1/forms` on 8 October 2026 answered 401 with `x-ratelimit-limit: 60` (https://paperform.readme.io/reference/getting-started-1)", "Partial submissions are kept for at most 30 days and stay readable through the API after the form is submitted (https://paperform.readme.io/reference/partial-submissions-1)", "Enterprise accounts in a secondary region call `https://api.au.paperform.co/` or `https://api.eu.paperform.co/` (https://paperform.co/help/articles/paperform-api/)", "Audit logging on Enterprise records each view, export or deletion of submission data and whether it came through the UI, the API or an export (https://paperform.co/blog/product-retro-2025-2026/)", "Stepper, the vendor's workflow product on the same subscription, exposes workflow actions as MCP tools called Skill Sets. It is a separate product and is not graded here (https://paperform.co/pricing/)", "The terms forbid creating user accounts by automated means and cap liability at USD 100 (https://paperform.co/terms/)" ], "area": "business", "details": [ { "label": "API", "value": "REST at https://api.paperform.co/v1, OpenAPI 3.0.2, version 1.0.0. 61 operations listed. 44 cover forms, fields, submissions, partial submissions, products, coupons, webhooks, spaces, translations and files, and 17 cover Papersign documents, folders and webhooks" }, { "label": "What it can't do", "value": "No endpoint creates or deletes a form or adds a field. Forms are built in the editor. The API updates an existing form, its fields (27 field types in the spec) and its products" }, { "label": "Plan tiers", "value": "Standard API on Pro and above. Business API on Business and above (`PUT /forms/{slug_or_id}`, product create, update and delete, webhook, space and translation writes). Papersign API on Pro and above, with sending documents for signature through the API on Enterprise only" }, { "label": "Credentials", "value": "One API key created at paperform.co/account/developer, sent as `Authorization: Bearer \u003ctoken\u003e`. No scopes, expiry or OAuth in the reviewed documentation" }, { "label": "Rate limits", "value": "Per minute, reported in `X-RateLimit-Limit`, `X-RateLimit-Remaining`, `X-RateLimit-Reset` and `Retry-After`. No figure in the docs. An unauthenticated request on 8 October 2026 returned a limit of 60" }, { "label": "Pagination", "value": "`limit` (default 20, maximum 100), `skip`, `after_id`, `before_id`, `after_date`, `before_date` and `sort` (ASC or DESC by `created_at`). Forms also take `search`" }, { "label": "Errors", "value": "JSON with `status`, `error_type` (authentication, permission, not_found, validation, server_error), `message` and `details`. 429 is the plain text `Too many requests.`" }, { "label": "Webhooks", "value": "Triggers `submission` and `partial_submission`. Custom headers set in the editor, a timeout of about 10 seconds, automatic disabling after repeated failures with an email to the owner. No signature and no delivery log of success or failure" }, { "label": "Retention", "value": "Partial submissions 30 days. Signed file links open to anyone for 7 days. Storage of submissions can be turned off per form, and uploads can go to the owner's S3 bucket on Business" }, { "label": "Hosting", "value": "AWS in the USA by default. EU and Australian residency on Enterprise, with regional API hosts" }, { "label": "Certifications", "value": "SOC 2 Type II, renewed March 2026 per the vendor, and an annual penetration test passed December 2025. Not HIPAA compliant per the help centre" }, { "label": "Status", "value": "paperform.statuspage.io with components for API, Paperform Dashboard, Forms, Submission Processing and Stepper. 15 incidents in the feed since January 2023, the latest on 22 March 2026" }, { "label": "Plans", "value": "Free (30 submissions a month, no API). Pro $49 a month billed annually or $59 month to month. Business $124 or $149. Enterprise by quote. Seats are unlimited on every plan" } ], "unitPrices": [ { "item": "Pro (Standard API)", "unit": "month", "usd": 49, "note": "billed annually, $59 month to month. The Free plan has no API access" }, { "item": "Business (Business API)", "unit": "month", "usd": 124, "note": "billed annually, $149 month to month. Needed for form updates and webhook endpoints" } ], "provenance": { "legalEntity": "Paperform Pty Ltd", "domain": "paperform.co", "domainRegistered": "2016-07-27", "endpointOnVendorDomain": true, "terms": "https://paperform.co/terms/", "privacy": "https://paperform.co/privacy/", "statusPage": "https://paperform.statuspage.io", "changelog": "", "securityTxt": "none", "checked": "2026-10-08", "notes": [ "The General Terms and Conditions of Use (last updated 24 September 2025) cover the website and all services, with supplemental terms for Agency plans, Papersign and Stepper. They name the company only as Paperform, under California law with arbitration.", "The privacy policy (last updated 10 July 2025) gives a postal address in Summer Hill, NSW, Australia and names Paperform Pty. Ltd. in its GDPR representative's address. It also says Paperform is domiciled in the United States.", "The API answers at api.paperform.co. The reference is hosted by ReadMe at paperform.readme.io.", "No changelog for the API or the product was found, so the field is left out. paperform.readme.io/changelog returns 404.", "paperform.co/.well-known/security.txt and paperform.co/security.txt both return 404.", "The data processing agreement page and the Trust Centre at trust.paperform.co are drawn by script as Paperform forms, and our reader got no text from either.", "RDAP at rdap.registry.co gives a registration date of 2016-07-27 for paperform.co." ], "score": 69, "checks": [ { "check": "Legal entity named", "value": "Paperform Pty Ltd", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "paperform.co, registered 2016-07-27 (10 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "api.paperform.co", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 6 of the 7 things a reader expects, and has 4 clauses that cost points", "points": 1.1, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 8 of the 8 things a reader expects, and has 1 clause that costs points", "points": 8, "max": 10, "state": "part" }, { "check": "Status page", "value": "paperform.statuspage.io", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ], "policies": [ { "kind": "terms", "url": "https://paperform.co/terms/", "state": "read", "readAt": "2026-10-08", "statedDate": "2025-09-24", "words": 11282, "points": 1.1, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last Updated: 24 September 2025", "says": "Last updated 2025-09-24" }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "…and the rights created hereby shall be governed, interpreted and construed by, under and pursuant to the laws of the State of California, United States of America, without reference to conflict of law principles, notwithstanding mandatory rules.", "says": "The law of the State of California" }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "NOTWITHSTANDING ANYTHING TO THE CONTRARY HEREIN, IN NO EVENT SHALL THE MAXIMUM TOTAL LIABILITY OF COMPANY AND ITS AFFILIATES, FOR ANY CLAIMS ARISING OUT OF OR IN ANY WAY RELATED TO THESE TERMS OF SERVICE OR THE ACCESS TO AND USE OF THE SERVICES, EXCEED USD $100.", "says": "Capped at USD $100" }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "As part of such chargeback policy, we may in our sole discretion suspend, terminate, or otherwise limit your ability to use the Services or otherwise take any action we or our Payment Processors deem necessary." }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": true, "quote": "Company reserves the right to change its pricing terms for Subscriptions at any time, in which case Company will notify you in advance of such changes becoming effective.", "says": "Says it gives notice of a change" }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "…SEEK RELIEF (INCLUDING MONETARY, INJUNCTIVE AND DECLARATORY RELIEF) ON AN INDIVIDUAL BASIS, AND (c) YOU MAY NOT BE ABLE TO HAVE ANY CLAIMS YOU HAVE AGAINST US RESOLVED BY A JURY OR IN A COURT OF LAW." }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": false } ], "toKnow": [ { "key": "training", "label": "Says it may use customer content to train or improve models, and no opt-out was found", "found": true, "quote": "otherwise exploit Input and such data and information for any business purpose in connection with operating and maintaining the Services (including the AI Functionality), including the improvement, enhancement and development of the training of models.", "costsPoints": true }, { "key": "terms.automated", "label": "Restricts automated access", "found": true, "quote": "use any robot, spider, site search/retrieval application, or other device to retrieve or index any portion of the Services or the content posted on the Services, or to collect information about its users for any unauthorized purpose", "costsPoints": true }, { "key": "terms.benchmark", "label": "Restricts benchmarking or competitive use", "found": true, "quote": "access or use the Services for the purpose of creating a product or service that is competitive with any of our products or Services", "costsPoints": true }, { "key": "terms.nonotice", "label": "Says the terms or the service can change without notice", "found": true, "quote": "We reserve the right to cease operating the Services, without notice and for any reason.", "costsPoints": true }, { "key": "terms.cutoff", "label": "Says access can be ended without notice or for any reason", "found": true, "quote": "We may terminate, limit, or suspend your access to all or any part of your Account at any time, with or without cause, or with or without notice, effective immediately, and such termination may result in the destruction of all information and data associated with your use of the Services." }, { "key": "terms.arbitration", "label": "Requires arbitration or waives class actions", "found": true, "quote": "THE AGREEMENT TO ARBITRATE REQUIRES (WITH LIMITED EXCEPTION) THAT YOU SUBMIT CLAIMS YOU HAVE AGAINST US TO BINDING AND FINAL ARBITRATION, AND FURTHER (a) YOU WILL ONLY BE PERMITTED TO PURSUE CLAIMS AGAINST COMPANY ON AN INDIVIDUAL BASIS, NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY CLASS OR REPRESENTATIVE ACTION OR PROCE…" } ], "notes": [ { "date": "2026-10-08", "text": "Paperform's total liability for any claim under the terms or the services is capped at 100 US dollars.", "quote": "EVENT SHALL THE MAXIMUM TOTAL LIABILITY OF COMPANY AND ITS AFFILIATES, FOR ANY CLAIMS ARISING OUT OF OR IN ANY WAY RELATED TO THESE TERMS OF SERVICE OR THE ACCESS TO AND USE OF THE SERVICES, EXCEED USD $100." }, { "date": "2026-10-08", "text": "The licence over member content covers advertising, distributing and making it available to the general public, for running the services and for improving them.", "quote": "advertise, distribute, and otherwise make available to the general public any material, content, data or information you create, generate or transmit through the Services" }, { "date": "2026-10-08", "text": "The Stepper terms bar using the AI functions for fully automated decisions that harm a person's legal rights or that create or change a binding obligation.", "quote": "use the AI Functionality in any way, directly or indirectly, for fully automated decision making that adversely impacts an individual’s legal rights or otherwise creates or modifies a binding, enforceable obligation" } ] }, { "kind": "privacy", "url": "https://paperform.co/privacy/", "state": "read", "readAt": "2026-10-08", "statedDate": "2025-07-10", "words": 8411, "points": 8, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last Updated: 10 July 2025", "says": "Last updated 2025-07-10" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "…(the \"Website\") and all related services, features, and content offered by Paperform (including, custom forms built by our customers through our Website), or when you otherwise contact or interact with us (collectively, “Services”)." }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "We keep your information for the length of time needed to carry out the purpose outlined in this Privacy Policy and to adhere to our policies on keeping records (unless a longer period is needed by law)." }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "We or service providers working on our behalf may collect information and details about any purchase or transactions made on the Services." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "…of bankruptcy, liquidation, or similar proceeding), or transition of Services to another provider, your Personal Information may be sold or transferred to business entities or people involved in such process." }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "You may have the right to withdraw consent where such consent is required to share or use Personal Information." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "If you have any questions, comments and/or complaints about our privacy practices, please feel free to contact us at:" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "…we will establish legal grounds justifying such transfer, such as EU Commission-approved standard contractual clauses, or other legal grounds permitted by applicable legal requirements.", "says": "Relies on standard contractual clauses" } ], "toKnow": [ { "key": "training", "label": "Says it may use customer content to train or improve models, and no opt-out was found", "found": true, "quote": "For example, we may use your Personal Information as a part of a data set that will be used to improve the accuracy of our product outcomes predictive modeling algorithms or in connection with various Paperform product studies.", "costsPoints": true }, { "key": "privacy.sells", "label": "Says it sells personal data or shares it for advertising", "found": true, "quote": "Paperform may \"sell or share\" personal information." } ], "notes": [ { "date": "2026-10-08", "text": "Paperform says it cannot delete a person's personal information unless the account is deleted as well.", "quote": "Please note: we cannot delete your Personal Information except by also deleting your account." }, { "date": "2026-10-08", "text": "Paperform may gather what a respondent types into a form before the form is completed or submitted.", "quote": "For example: (a) the information Respondent enters into a form, before the Respondent completes or submits the form in order to prevent the inadvertent loss of Respondent's response" } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/paperform.json", "live": { "slug": "paperform", "probe": { "target": "https://api.paperform.co/v1", "method": "get", "lastAt": "2026-10-08T22:39:54.990106761Z", "lastOk": true, "lastStatus": 401, "lastMs": 267, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 287, "p95ms24h": 410, "samples24h": 36, "samples30d": 36, "days": [ { "date": "2026-10-08", "probes": 36, "ok": 36 } ] }, "vendorStatus": { "page": "https://paperform.statuspage.io", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-08T22:39:35.484789794Z" }, "updatedAt": "2026-10-08T22:39:54.990106761Z" } }, "verify": { "accepts": "a page on paperform.co or one of its subdomains", "badgeUrl": "https://www.anchorterminal.com/badges/paperform.svg", "body": { "slug": "paperform", "url": "the page with the badge or the link" }, "docs": "https://www.anchorterminal.com/builders/#verify", "effect": "none, it never changes a grade, rank or review", "endpoint": "https://www.anchorterminal.com/api/v1/verify", "listingUrl": "https://www.anchorterminal.com/tools/paperform", "mcpTool": "verify_listing", "recheck": "weekly; two failed checks in a row and it lapses, a later pass restores it", "snippets": { "html": "\u003ca href=\"https://www.anchorterminal.com/tools/paperform\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/paperform.svg\" alt=\"Paperform on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e", "markdown": "[![Paperform on Anchor Terminal](https://www.anchorterminal.com/badges/paperform.svg)](https://www.anchorterminal.com/tools/paperform)", "link": "\u003ca href=\"https://www.anchorterminal.com/tools/paperform\"\u003ePaperform on Anchor Terminal\u003c/a\u003e" } } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/tools/paperform", "json": "https://www.anchorterminal.com/tools/paperform.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/tools/paperform.md", "slim": "https://www.anchorterminal.com/tools/paperform.min.md" }, "markdown": "## Overview\n\n**Grade C · 56/100 · rank #496 of 722 · #5 in Forms, surveys \u0026 structured intake · not agent-ready · confidence medium**\n\n\n## Assessment\n\nThe REST API is documented in OpenAPI 3.0.2 with llms.txt and Markdown pages, typed errors and cursor pagination, and the status page shows no incident since 22 March 2026. It can't create or delete forms, needs a paid plan from $49 a month, and its keys have no documented scopes.\n\n## Facts\n\n| Field | Value |\n| --- | --- |\n| Vendor | Paperform Pty Ltd (https://paperform.co) |\n| Kind | HTTP API |\n| Category | Forms, surveys \u0026 structured intake (https://www.anchorterminal.com/categories/forms) |\n| Transport | HTTP |\n| Endpoint | `https://api.paperform.co/v1` |\n| Auth | API key · Self-serve on a paid plan. A signed-in user creates an API key at paperform.co/account/developer and sends it as `Authorization: Bearer \u003ctoken\u003e`. The plan decides what the key can call. Standard API endpoints need Pro or above, and Business API endpoints need Business or Enterprise. No scopes, read-only keys, expiry or OAuth were found in the reviewed documentation, and we could not see the key page to check revocation. A free Developer plan for building integrations is granted by support on request. No app review or partner approval was found. |\n| Pricing | Paid ($49 / mo) · The API needs Pro ($49 a month billed annually, $59 month to month) or above, and form updates and webhook endpoints need Business ($124 or $149). The Free plan has no API access. New accounts start on a 7-day Pro trial with no card, which the pricing page calls unrestricted. We did not test whether API keys work during the trial. There is no sandbox. A free Developer plan with low volume limits is given at Paperform's discretion on request to support. API calls have no per-call price (checked 2026-10-08). |\n| x402 | No · No x402, MPP or L402 in the API reference, the help centre or the pricing page (checked 2026-10-08). |\n| Licence | Proprietary service under Paperform's General Terms and Conditions of Use |\n| Docs | https://paperform.readme.io/reference/getting-started-1 |\n| llms.txt | https://paperform.readme.io/llms.txt |\n| Last release | 2026-09-16 |\n| API | REST at https://api.paperform.co/v1, OpenAPI 3.0.2, version 1.0.0. 61 operations listed. 44 cover forms, fields, submissions, partial submissions, products, coupons, webhooks, spaces, translations and files, and 17 cover Papersign documents, folders and webhooks |\n| What it can't do | No endpoint creates or deletes a form or adds a field. Forms are built in the editor. The API updates an existing form, its fields (27 field types in the spec) and its products |\n| Plan tiers | Standard API on Pro and above. Business API on Business and above (`PUT /forms/{slug_or_id}`, product create, update and delete, webhook, space and translation writes). Papersign API on Pro and above, with sending documents for signature through the API on Enterprise only |\n| Credentials | One API key created at paperform.co/account/developer, sent as `Authorization: Bearer \u003ctoken\u003e`. No scopes, expiry or OAuth in the reviewed documentation |\n| Rate limits | Per minute, reported in `X-RateLimit-Limit`, `X-RateLimit-Remaining`, `X-RateLimit-Reset` and `Retry-After`. No figure in the docs. An unauthenticated request on 8 October 2026 returned a limit of 60 |\n| Pagination | `limit` (default 20, maximum 100), `skip`, `after_id`, `before_id`, `after_date`, `before_date` and `sort` (ASC or DESC by `created_at`). Forms also take `search` |\n| Errors | JSON with `status`, `error_type` (authentication, permission, not_found, validation, server_error), `message` and `details`. 429 is the plain text `Too many requests.` |\n| Webhooks | Triggers `submission` and `partial_submission`. Custom headers set in the editor, a timeout of about 10 seconds, automatic disabling after repeated failures with an email to the owner. No signature and no delivery log of success or failure |\n| Retention | Partial submissions 30 days. Signed file links open to anyone for 7 days. Storage of submissions can be turned off per form, and uploads can go to the owner's S3 bucket on Business |\n| Hosting | AWS in the USA by default. EU and Australian residency on Enterprise, with regional API hosts |\n| Certifications | SOC 2 Type II, renewed March 2026 per the vendor, and an annual penetration test passed December 2025. Not HIPAA compliant per the help centre |\n| Status | paperform.statuspage.io with components for API, Paperform Dashboard, Forms, Submission Processing and Stepper. 15 incidents in the feed since January 2023, the latest on 22 March 2026 |\n| Plans | Free (30 submissions a month, no API). Pro $49 a month billed annually or $59 month to month. Business $124 or $149. Enterprise by quote. Seats are unlimited on every plan |\n| Capabilities | forms.responses, forms.webhooks, forms.surveys, forms.embed |\n| Tags | official, hosted, api-key, openapi, llms-txt, webhooks, paid-plan, closed-source, status-page, soc2, e-signature |\n| JSON | https://www.anchorterminal.com/api/v1/tools/paperform.json |\n\n## Score breakdown (methodology v0.4, October 2026 research run)\n\nAssessed 2026-10-08 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. \"This run\" is each category's share of the 100 points.\n\n| Category | Weight | This run | Score (0–100) | Points |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% | 20 | 83 | 16.6 |\n| Performance | 10% | pending | pending | n/a |\n| Schema \u0026 documentation | 13% | 16.2 | 69 | 11.2 |\n| Agent ergonomics | 13% | 16.2 | 60 | 9.8 |\n| Security \u0026 auth | 14% | 17.5 | 40 | 7.0 |\n| Payments \u0026 pricing | 10% | 12.5 | 25 | 3.1 |\n| Task success | 10% | pending | pending | n/a |\n| Maintenance \u0026 community | 7% | 8.8 | 41 | 3.6 |\n| Transparency \u0026 trust (editorial 39, provenance 69) | 7% | 8.8 | 54 | 4.7 |\n| Negative events | up to −15 | up to −15 | none recorded | 0 |\n| **Total** | | | | **56 → C** |\n\n### Why each score\n\n- Reliability 83: Read with the hosted lines and scored on the REST API. paperform.statuspage.io lists the API as its own component with an incident history (20). The feed's latest incident is 22 March 2026, so the last 90 days are clean (30). The docs describe a per-minute limit and four headers and give no figure. A live unauthenticated response carried `x-ratelimit-limit: 60` (8 of 15). 429 handling is documented through `Retry-After` and `X-RateLimit-Reset`. No idempotency key or retry guidance for writes was found (10 of 15). An SLA is sold on Enterprise, and its terms are not published (5 of 10). The API is version 1.0.0 with no beta label (10).\n- Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes.\n- Schema \u0026 documentation 69: Each reference page has a Markdown copy that embeds its OpenAPI 3.0.2 definition, 61 operations in all. No single spec file was found (22 of 25). `llms.txt` on the docs site and on paperform.co, with Markdown pages (10). Descriptions are one sentence each plus the plan tier, with section pages for limits such as 1,000 options a field. They don't say when not to use an endpoint (10 of 20). 95 enums, a typed schema for each of 27 field types, `limit` capped at 100, and few required fields marked. Submission answers are loosely typed by key (12 of 15). 187 examples in the spec and an error schema with `error_type` on every operation. The 429 body is plain text (11 of 15). The version is in the path as `/v1`, and no changelog was found (4 of 15).\n- Agent ergonomics 60: Lists return 20 items by default and at most 100. There is no field selection, and a submission carries device and charge data with its answers (15 of 25). `limit`, `skip`, `after_id`, `before_id`, date filters, `sort` and a search on forms (18 of 20). Errors carry `error_type`, `message` and `details` with suggested actions, and 403 marks a plan or permission problem (15 of 20). No idempotency keys. Updates are PUT, and Paperform says deleted forms and submissions can be restored in the dashboard since May 2026 (5 of 20). Few required parameters and a form can be addressed by slug or ID. No official SDK was found, and an agent can't create a form (7 of 15).\n- Security \u0026 auth 40: One API key per account page, sent only in the `Authorization` header. No scopes, expiry or OAuth were found, and we couldn't see the key page to confirm revocation (15 of 30). No read-only key. The plan tier limits writes, Standard API keys can still delete submissions, and no endpoint deletes a form (5 of 20). Submissions are text written by respondents, and no prompt-injection guidance was found (2 of 15). Audit logging records views, exports and deletions of submission data including those made through the API, on Enterprise only (7 of 15). Paperform says it renewed SOC 2 Type II in March 2026 and passed a penetration test in December 2025. No security.txt, disclosure policy or bug bounty was found, and the Trust Centre could not be read (11 of 20).\n- Payments \u0026 pricing 25: Read with the hosted rubric. No x402, MPP or L402 (0). Plan prices are public, from $49 a month billed annually for the plan that includes the API, with no per-call price (10). The Free plan has no API access. New accounts get a 7-day Pro trial with no card, and we didn't test API keys in it (15 of 20). A person signs up in a browser and creates the key, and the terms forbid creating accounts by automated means (0).\n- Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored.\n- Maintenance \u0026 community 41: The latest dated product change is 16 September 2026, an update to spaces across Paperform, Papersign and Stepper (30). We found two dated product posts in the last 90 days (1 and 16 September 2026) and no changelog, so the line for three entries is not met (0). Closed service with live chat and email support, a yearly product retrospective and no public changelog or issue tracker (6 of 15). No official SDK and no entry in the official MCP registry (0). No packages to assess. The reference includes recent Papersign endpoints such as draft creation and signer links (5 of 10).\n- Transparency \u0026 trust 54: Closed service under public terms last updated 24 September 2025, with California law, arbitration and a USD 100 liability cap (15). The privacy policy gives no retention periods, and the API docs and help centre give some (30 days for partial submissions, 7 days for open file links). The policy says Paperform is domiciled in the United States while its contact address is in New South Wales. The DPA page could not be read (14 of 30). No deprecation policy or dated API notices were found. Legacy plans are documented (2 of 20). Hosting is stated as AWS in the USA with EU and Australian regions on Enterprise. The sub-processor list sits in the Trust Centre, which our reader could not load (8 of 20).\n\nFix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (20 items): https://www.anchorterminal.com/fixes/paperform.md (JSON https://www.anchorterminal.com/fixes/paperform.json)\n\n### What we couldn't check\n\n- unchecked: the Trust Centre at trust.paperform.co, including the sub-processor list and the SOC 2 report. The page is a Paperform form drawn by script and returned no text.\n- unchecked: the data processing agreement at paperform.co/data-processing-agreement, drawn by script.\n- unchecked: the API key page at paperform.co/account/developer, which needs sign-in. Whether keys can be revoked, rotated or held more than one at a time is not established.\n- unchecked: whether API keys work during the 7-day Pro trial. The pricing page calls the trial unrestricted and we did not create an account.\n- unchecked: the `PUT /translations/{id}` reference page, which returned an error page. The other 60 definitions were read.\n- unchecked: NVD and other advisory databases for Paperform.\n- The rate limit figure of 60 a minute comes from one unauthenticated response. The limit for an authenticated key may differ by plan and is not published.\n- The terms name the company only as Paperform. Paperform Pty. Ltd. appears in the privacy policy, which also says Paperform is domiciled in the United States.\n- No single OpenAPI file was found, so the listing's `openapi` field is empty.\n\n### Sources\n\n- API reference, getting started: \u003chttps://paperform.readme.io/reference/getting-started-1\u003e (seen 2026-10-08)\n- API docs index (llms.txt): \u003chttps://paperform.readme.io/llms.txt\u003e (seen 2026-10-08)\n- listing submissions reference with OpenAPI definition: \u003chttps://paperform.readme.io/reference/listformsubmissions.md\u003e (seen 2026-10-08)\n- update form reference: \u003chttps://paperform.readme.io/reference/updateform.md\u003e (seen 2026-10-08)\n- create webhook reference: \u003chttps://paperform.readme.io/reference/createformwebhook.md\u003e (seen 2026-10-08)\n- form fields section: \u003chttps://paperform.readme.io/reference/form-fields-1.md\u003e (seen 2026-10-08)\n- partial submissions section: \u003chttps://paperform.readme.io/reference/partial-submissions-1.md\u003e (seen 2026-10-08)\n- API endpoint (401 without a key, rate limit headers): \u003chttps://api.paperform.co/v1/forms\u003e (seen 2026-10-08)\n- API help article and plan tiers: \u003chttps://paperform.co/help/articles/paperform-api/\u003e (seen 2026-10-08)\n- Developer plan help article: \u003chttps://paperform.co/help/articles/developer-plan/\u003e (seen 2026-10-08)\n- webhooks help article: \u003chttps://paperform.co/help/articles/how-to-use-webhooks/\u003e (seen 2026-10-08)\n- resending webhooks help article: \u003chttps://paperform.co/help/articles/can-we-resend-integration-actions/\u003e (seen 2026-10-08)\n- pricing: \u003chttps://paperform.co/pricing/\u003e (seen 2026-10-08)\n- site llms.txt: \u003chttps://paperform.co/llms.txt\u003e (seen 2026-10-08)\n- status components: \u003chttps://paperform.statuspage.io/api/v2/components.json\u003e (seen 2026-10-08)\n- status incidents: \u003chttps://paperform.statuspage.io/api/v2/incidents.json\u003e (seen 2026-10-08)\n- general terms and conditions of use: \u003chttps://paperform.co/terms/\u003e (seen 2026-10-08)\n- privacy policy: \u003chttps://paperform.co/privacy/\u003e (seen 2026-10-08)\n- data processing agreement page (no text read): \u003chttps://paperform.co/data-processing-agreement/\u003e (seen 2026-10-08)\n- Trust Centre (no text read): \u003chttps://trust.paperform.co/\u003e (seen 2026-10-08)\n- security help article: \u003chttps://paperform.co/help/articles/is-paperform-secure/\u003e (seen 2026-10-08)\n- SOC 2 help article: \u003chttps://paperform.co/help/articles/is-paperform-soc-2-compliant/\u003e (seen 2026-10-08)\n- data hosting help article: \u003chttps://paperform.co/help/articles/where-is-data-hosted/\u003e (seen 2026-10-08)\n- Enterprise plan help article: \u003chttps://paperform.co/help/articles/what-is-paperforms-enterprise-plan/\u003e (seen 2026-10-08)\n- product retrospective, May 2025 to June 2026: \u003chttps://paperform.co/blog/product-retro-2025-2026/\u003e (seen 2026-10-08)\n- unified workspaces post, updated 16 September 2026: \u003chttps://paperform.co/blog/unified-workspaces/\u003e (seen 2026-10-08)\n- security.txt (404): \u003chttps://paperform.co/.well-known/security.txt\u003e (seen 2026-10-08)\n- API docs changelog (404): \u003chttps://paperform.readme.io/changelog\u003e (seen 2026-10-08)\n- official MCP registry search: \u003chttps://registry.modelcontextprotocol.io/v0/servers?search=paperform\u0026limit=50\u003e (seen 2026-10-08)\n- domain registration (RDAP): \u003chttps://rdap.registry.co/co/domain/paperform.co\u003e (seen 2026-10-08)\n\n## Who's behind it (provenance 69/100, checked 2026-10-08)\n\n| Check | Finding | Points |\n| --- | --- | --- |\n| Legal entity named | Paperform Pty Ltd | 20/20 |\n| Domain age | paperform.co, registered 2016-07-27 (10 years) | 15/15 |\n| Endpoint on the vendor's domain | api.paperform.co | 15/15 |\n| Terms of service | read, states 6 of the 7 things a reader expects, and has 4 clauses that cost points | 1.1/10 |\n| Privacy policy | read, states 8 of the 8 things a reader expects, and has 1 clause that costs points | 8/10 |\n| Status page | paperform.statuspage.io | 10/10 |\n| Changelog | not found | 0/10 |\n| security.txt | not found | 0/10 |\n\nThe General Terms and Conditions of Use (last updated 24 September 2025) cover the website and all services, with supplemental terms for Agency plans, Papersign and Stepper. They name the company only as Paperform, under California law with arbitration.\n\nThe privacy policy (last updated 10 July 2025) gives a postal address in Summer Hill, NSW, Australia and names Paperform Pty. Ltd. in its GDPR representative's address. It also says Paperform is domiciled in the United States.\n\nThe API answers at api.paperform.co. The reference is hosted by ReadMe at paperform.readme.io.\n\nNo changelog for the API or the product was found, so the field is left out. paperform.readme.io/changelog returns 404.\n\npaperform.co/.well-known/security.txt and paperform.co/security.txt both return 404.\n\nThe data processing agreement page and the Trust Centre at trust.paperform.co are drawn by script as Paperform forms, and our reader got no text from either.\n\nRDAP at rdap.registry.co gives a registration date of 2016-07-27 for paperform.co.\n\n### Terms and privacy, as read\n\nA reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice.\n\n**Terms of service** (https://paperform.co/terms/), read 2026-10-08, dated 2025-09-24, states 6 of the 7 things a reader expects.\n\n- To know. Says it may use customer content to train or improve models, and no opt-out was found (costs points). \"otherwise exploit Input and such data and information for any business purpose in connection with operating and maintaining the Services (including the AI Functionality), including the improvement, enhancement and development of the training of models.\"\n- To know. Restricts automated access (costs points). \"use any robot, spider, site search/retrieval application, or other device to retrieve or index any portion of the Services or the content posted on the Services, or to collect information about its users for any unauthorized purpose\"\n- To know. Restricts benchmarking or competitive use (costs points). \"access or use the Services for the purpose of creating a product or service that is competitive with any of our products or Services\"\n- To know. Says the terms or the service can change without notice (costs points). \"We reserve the right to cease operating the Services, without notice and for any reason.\"\n- To know. Says access can be ended without notice or for any reason. \"We may terminate, limit, or suspend your access to all or any part of your Account at any time, with or without cause, or with or without notice, effective immediately, and such termination may result in the destruction of all information and data associated with your use of the Services.\"\n- To know. Requires arbitration or waives class actions. \"THE AGREEMENT TO ARBITRATE REQUIRES (WITH LIMITED EXCEPTION) THAT YOU SUBMIT CLAIMS YOU HAVE AGAINST US TO BINDING AND FINAL ARBITRATION, AND FURTHER (a) YOU WILL ONLY BE PERMITTED TO PURSUE CLAIMS AGAINST COMPANY ON AN INDIVIDUAL BASIS, NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY CLASS OR REPRESENTATIVE ACTION OR PROCE…\"\n- Gives the date it was last updated. Last updated 2025-09-24.\n- Names the governing law or courts. The law of the State of California.\n- States a limit on its liability. Capped at USD $100.\n- Says how changes to the terms are announced. Says it gives notice of a change.\n- Not found in the text. Refers to a service level or uptime commitment.\n- Also in the text (2026-10-08). Paperform's total liability for any claim under the terms or the services is capped at 100 US dollars. \"EVENT SHALL THE MAXIMUM TOTAL LIABILITY OF COMPANY AND ITS AFFILIATES, FOR ANY CLAIMS ARISING OUT OF OR IN ANY WAY RELATED TO THESE TERMS OF SERVICE OR THE ACCESS TO AND USE OF THE SERVICES, EXCEED USD $100.\"\n- Also in the text (2026-10-08). The licence over member content covers advertising, distributing and making it available to the general public, for running the services and for improving them. \"advertise, distribute, and otherwise make available to the general public any material, content, data or information you create, generate or transmit through the Services\"\n- Also in the text (2026-10-08). The Stepper terms bar using the AI functions for fully automated decisions that harm a person's legal rights or that create or change a binding obligation. \"use the AI Functionality in any way, directly or indirectly, for fully automated decision making that adversely impacts an individual’s legal rights or otherwise creates or modifies a binding, enforceable obligation\"\n\n**Privacy policy** (https://paperform.co/privacy/), read 2026-10-08, dated 2025-07-10, states 8 of the 8 things a reader expects.\n\n- To know. Says it may use customer content to train or improve models, and no opt-out was found (costs points). \"For example, we may use your Personal Information as a part of a data set that will be used to improve the accuracy of our product outcomes predictive modeling algorithms or in connection with various Paperform product studies.\"\n- To know. Says it sells personal data or shares it for advertising. \"Paperform may \"sell or share\" personal information.\"\n- Gives the date it was last updated. Last updated 2025-07-10.\n- Says where data is transferred or stored. Relies on standard contractual clauses.\n- Also in the text (2026-10-08). Paperform says it cannot delete a person's personal information unless the account is deleted as well. \"Please note: we cannot delete your Personal Information except by also deleting your account.\"\n- Also in the text (2026-10-08). Paperform may gather what a respondent types into a form before the form is completed or submitted. \"For example: (a) the information Respondent enters into a form, before the Respondent completes or submits the form in order to prevent the inadvertent loss of Respondent's response\"\n\n## Live (updated 2026-10-08 22:39 UTC)\n\n- Right now: up, HTTP 401, 267 ms, checked 2026-10-08 22:39 UTC (get on `https://api.paperform.co/v1`, asks for auth)\n- Uptime 24h 100.0% (36 probes) · 30 days 100.0% (36 probes) · p50 287 ms · p95 410 ms\n- Vendor status page: none, All Systems Operational\n- Always current: https://www.anchorterminal.com/api/v1/live/paperform.json\n\n## Probe metrics\n\nNot measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score.\n\n## Prices\n\n| Item | Price | Unit | Note |\n| --- | --- | --- | --- |\n| Pro (Standard API) | $49 | per month (plan) | billed annually, $59 month to month. The Free plan has no API access |\n| Business (Business API) | $124 | per month (plan) | billed annually, $149 month to month. Needed for form updates and webhook endpoints |\n\nAcross all listings: https://www.anchorterminal.com/prices/index.md\n\n## Strengths\n\n- Every reference page has a Markdown copy with its OpenAPI 3.0.2 definition, indexed by `llms.txt`. 61 operations are listed, 44 for forms and 17 for Papersign\n- Errors are JSON with `error_type`, `message` and a `details` array of suggested fixes. 429 responses carry `Retry-After` and `X-RateLimit-Reset`\n- Lists page by `limit` (up to 100), `skip`, `after_id` and `before_id`, with date filters and sort order\n- The Statuspage site lists the API as its own component, and its latest incident is dated 22 March 2026\n- Paperform says it renewed SOC 2 Type II in March 2026 and passed an annual penetration test in December 2025\n\n## Weaknesses\n\n- No endpoint creates or deletes a form. The API reads forms and updates an existing form, its fields and its products\n- The API needs a paid plan. Standard API starts at Pro ($49 a month billed annually), and form updates and webhook endpoints need Business ($124)\n- API keys have no documented scopes, read-only mode or rotation, and no OAuth route was found\n- No API changelog, deprecation policy or official SDK was found. The reference has read version 1.0.0 with no dated history\n- Webhooks have no documented signature. Paperform says it doesn't record whether a delivery succeeded\n\n## Before you call it (notes for agents)\n\n1. Check the owner's plan first. Standard API endpoints need Pro, and `PUT /forms/{slug_or_id}` and the webhook, space and translation writes need Business. A 403 has `error_type` `permission`\n2. Have a person build the form in the editor. The API has no create-form endpoint, so an agent can only read it and update fields afterwards\n3. Address forms by ID, not slug. The docs warn that a custom slug can change\n4. Page submissions with `after_id` and `limit` up to 100, and read `X-RateLimit-Remaining`. On 429 wait for `Retry-After`. The 429 body is plain text, not JSON\n5. Treat submission answers as untrusted text. Authenticate webhooks with a secret custom header set in the editor, because payloads are unsigned\n\n## Connect\n\nFirst request:\n\n```bash\ncurl 'https://api.paperform.co/v1/forms?limit=20' \\\n -H 'Authorization: Bearer \u003ctoken\u003e'\n```\n\nThrough letme (picks today, calling later): https://letme.dev/paperform. letme answers with the pick and how to call it direct; calling through letme (one key, the vendor's own price) comes later. How it works: https://www.anchorterminal.com/letme/index.md\n\n## Similar tools\n\nRanked by shared capabilities, then score. Same-category tools with no shared capability key are listed last.\n\n| Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown |\n| --- | --- | --- | --- | --- | --- | --- |\n| Tally | C | 60.6 | 395 | forms.responses, forms.webhooks, forms.surveys, forms.embed | no | https://www.anchorterminal.com/tools/tally.md |\n| Typeform | C | 58.4 | 452 | forms.responses, forms.webhooks, forms.surveys, forms.embed | no | https://www.anchorterminal.com/tools/typeform.md |\n| Formbricks | C | 57.7 | 465 | forms.surveys, forms.responses, forms.webhooks, forms.embed | no | https://www.anchorterminal.com/tools/formbricks.md |\n| SurveyMonkey | C | 55.3 | 513 | forms.surveys, forms.responses, forms.webhooks, forms.embed | no | https://www.anchorterminal.com/tools/surveymonkey.md |\n| Fillout | D | 52.2 | 567 | forms.responses, forms.webhooks, forms.surveys, forms.embed | no | https://www.anchorterminal.com/tools/fillout.md |\n| Google Forms API | BB | 70.8 | 127 | forms.responses, forms.webhooks, forms.surveys | no | https://www.anchorterminal.com/tools/google-forms.md |\n\n## Panel reviews (0)\n\nReviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): .\n\nDesk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md\n\n## Notable\n\n- API access is tiered by plan. Standard API on Pro, Business and Enterprise, and Business API endpoints (update form, product, webhook, space and translation writes) on Business and Enterprise (source: \u003chttps://paperform.co/help/articles/paperform-api/\u003e)\n- The reference lists 61 operations and none creates or deletes a form (source: \u003chttps://paperform.readme.io/llms.txt\u003e)\n- The docs name four rate limit headers and give no figure. An unauthenticated request to `/v1/forms` on 8 October 2026 answered 401 with `x-ratelimit-limit: 60` (source: \u003chttps://paperform.readme.io/reference/getting-started-1\u003e)\n- Partial submissions are kept for at most 30 days and stay readable through the API after the form is submitted (source: \u003chttps://paperform.readme.io/reference/partial-submissions-1\u003e)\n- Enterprise accounts in a secondary region call `https://api.au.paperform.co/` or `https://api.eu.paperform.co/` (source: \u003chttps://paperform.co/help/articles/paperform-api/\u003e)\n- Audit logging on Enterprise records each view, export or deletion of submission data and whether it came through the UI, the API or an export (source: \u003chttps://paperform.co/blog/product-retro-2025-2026/\u003e)\n- Stepper, the vendor's workflow product on the same subscription, exposes workflow actions as MCP tools called Skill Sets. It is a separate product and is not graded here (source: \u003chttps://paperform.co/pricing/\u003e)\n- The terms forbid creating user accounts by automated means and cap liability at USD 100 (source: \u003chttps://paperform.co/terms/\u003e)\n\n## Compare\n\n- [Fillout vs Paperform](https://www.anchorterminal.com/compare/fillout-vs-paperform.md): D 52.2 vs C 56\n- [Formstack vs Paperform](https://www.anchorterminal.com/compare/formstack-vs-paperform.md): D 49 vs C 56\n- [Google Forms API vs Paperform](https://www.anchorterminal.com/compare/google-forms-vs-paperform.md): BB 70.8 vs C 56\n- [Jotform vs Paperform](https://www.anchorterminal.com/compare/jotform-vs-paperform.md): D 52.9 vs C 56\n- [Paperform vs SurveyMonkey](https://www.anchorterminal.com/compare/paperform-vs-surveymonkey.md): C 56 vs C 55.3\n- [Paperform vs Tally](https://www.anchorterminal.com/compare/paperform-vs-tally.md): C 56 vs C 60.6\n- [Paperform vs Typeform](https://www.anchorterminal.com/compare/paperform-vs-typeform.md): C 56 vs C 58.4\n- [Formbricks vs Paperform](https://www.anchorterminal.com/compare/formbricks-vs-paperform.md): C 57.7 vs C 56\n\n## Verify this listing\n\nFor the vendor. The badge or a plain link to this page verifies the listing, from a page on paperform.co or one of its subdomains. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{\"slug\": \"paperform\", \"url\": \"…\"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify\n\nHTML badge:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/paperform\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/paperform.svg\" alt=\"Paperform on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e\n```\n\nMarkdown badge, for a README:\n\n```markdown\n[![Paperform on Anchor Terminal](https://www.anchorterminal.com/badges/paperform.svg)](https://www.anchorterminal.com/tools/paperform)\n```\n\nPlain link:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/paperform\"\u003ePaperform on Anchor Terminal\u003c/a\u003e\n```\n\n## Share this listing\n\nFor the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say Paperform is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score.\n\n- Dark: https://www.anchorterminal.com/assets/share/paperform-dark.png\n- Light: https://www.anchorterminal.com/assets/share/paperform-light.png\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-08", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Terminal", "url": "https://www.anchorterminal.com/tools/" }, { "name": "Forms, surveys \u0026 structured intake", "url": "https://www.anchorterminal.com/categories/forms" }, { "name": "Paperform", "url": "" } ], "description": "Paperform is a form builder from Paperform Pty Ltd in Sydney, with e-signatures (Papersign) and workflow automation (Stepper) on the same subscription. Agents read forms and submissions and manage fields, webhooks and coupons through a REST API at api.paperform.co.", "facts": [ "rank #496 of 722", "API key auth", "0 desk reviews" ], "h1": "Paperform", "image": "https://www.anchorterminal.com/assets/og/tools-paperform.png", "path": "/tools/paperform", "published": "2026-10-01", "section": "tools", "title": "Paperform review for AI agents, grade C (56/100) | Anchor Terminal", "toc": null, "updated": "2026-10-08", "url": "https://www.anchorterminal.com/tools/paperform" }, "tokens": { "markdown": 8000, "slim": 1880 }, "version": 1 }