Papermark

Papermark is an open-source document-sharing platform built as a self-hostable alternative to DocSend. It lets teams share pitch decks, contracts, NDAs, and sales collateral through secure, branded links — tracking how recipients engage with every page in real time. The platform goes well beyond basic link sharing with enterprise-grade data rooms, granular file permissions, and an analytics pipeline that captures dwell time per page rather than just total document views.

Designed for sales teams, venture capitalists, real estate agents, and startups, Papermark answers a real question: who opened your document, which pages captured their attention, and where did they disengage. Unlike closed SaaS tools, the entire codebase is open and self-hostable, giving organizations full control over where sensitive documents are stored and who can access viewing data.

The platform has evolved rapidly from a simple link-sharing tool into a full document intelligence suite. Data rooms support hierarchical folder structures, group-based access control, AI-powered Q&A conversations embedded directly in the viewer, file request links for collecting documents from external parties, and customizable branding including logos, accent colors, and welcome messages. Email notifications fire in real time when a link is opened, with Slack integration available for teams that prefer channel-based alerts.

Papermark is actively maintained with 14 tagged releases, over 8,500 stars, and contributions from 60+ developers. The cloud-hosted version at papermark.com offers managed infrastructure for teams that prefer not to self-host, with paid plans adding data rooms, advanced analytics, and SSO on top of the open-source core.

What You Get

• Per-Page Document Analytics — Track viewer dwell time on every individual page of a document, with real-time insights surfaced in a dashboard showing engagement depth, drop-off points, and total view duration.
• Secure Data Rooms — Organize multiple documents into structured, password-protected data rooms with folder hierarchies, per-group file permissions, and audit logs of every access event.
• Custom Domains and Branding — Replace default papermark.com URLs with your own domain and apply custom logos, accent colors, banners, and welcome messages to every viewer-facing interface.
• Self-Hosted Deployment — Run the full platform on your own infrastructure via Docker or direct Node.js deployment, keeping document data and analytics entirely within your control.
• AI-Powered Document Q&A — Enable viewers to ask questions about documents directly inside the data room viewer, with responses powered by OpenAI or Google Vertex AI without leaving the interface.
• Real-Time Notifications — Receive instant email or Slack alerts when a link is opened, including the viewer’s location, device, and which pages they accessed.
• File Request Links — Generate upload-only data room links that let external parties submit files directly into your data room without being able to view other contents.
• Dynamic Watermarking — Apply per-viewer watermarks to PDF documents at the rendering layer, embedding the viewer’s email address or custom text directly into pages to deter unauthorized sharing.
• Link Presets and Tags — Save reusable link configurations (expiry, password, download permissions, watermarks) as presets and organize links with color-coded tags for rapid searching and filtering.
• Webhook and API Integration — Send real-time events (link viewed, document uploaded, file requested) to external systems via outbound webhooks, with an OpenAPI-documented REST API and Model Context Protocol endpoint for programmatic access.

Common Use Cases

• Fundraising with investor data rooms — Startup founders create structured data rooms containing their pitch deck, financial models, and cap table, then share group links with specific investors to track exactly which documents each investor reviewed and for how long.
• Sales proposal tracking — Enterprise sales teams share branded proposal decks via Papermark links to see which prospects engaged with pricing pages versus skipping straight to the summary, helping reps prioritize follow-ups based on actual document engagement.
• Real estate transaction document management — Property managers and agents create data rooms containing NDAs, inspection reports, and purchase agreements, controlling which documents each buyer group can see and getting notified the moment a critical document is opened.
• Secure legal and compliance document distribution — Law firms and compliance teams distribute sensitive agreements through time-limited, watermarked links, with audit logs capturing every access event and the ability to revoke access instantly if circumstances change.
• Research report monetization — Analysts and consultants share gated research behind Papermark links that require email verification, tracking reader engagement by section to understand which content generates the most interest before investing in follow-up reports.

Under The Hood

Architecture Papermark is a deliberately hybrid Next.js monolith that uses the Pages Router for viewer-facing document and data room routes and the App Router for the authenticated team dashboard, optimizing rendering strategy by audience rather than treating router choice as a single global decision. Custom domain routing is resolved at the edge via middleware that inspects the host header and dispatches requests to either the application domain handler or a custom domain renderer, cleanly separating multi-tenant concerns from application logic before any route handler runs. Enterprise features live in an isolated ee/ directory with its own license, gated by plan checks drawn from Stripe subscriptions rather than scattered feature flags, so the commercial boundary is structurally enforced rather than convention-based. Background jobs are organized by business domain in lib/trigger/, with Trigger.dev providing durable execution for PDF-to-image conversion, video optimization, visit exports, and notification delivery — isolating long-running processing from the request cycle entirely.

Tech Stack Full-stack TypeScript application built on Next.js with Prisma 6.5 and PostgreSQL for transactional data and a split-schema approach for maintainability at scale. Tinybird serves as a dedicated column-store for event analytics, receiving typed page-view events over HTTP and enabling fast per-page dwell time queries without polluting the transactional database. Trigger.dev v4 orchestrates background processing including PDF rendering via mupdf, video optimization via ffmpeg, and Python scripts for document conversion tasks. Storage is dual-target — AWS S3 with CloudFront signing or Vercel Blob, configured per team — and Redis provides caching and job state tracking. Authentication is handled by NextAuth.js with a Prisma adapter, extended by Hanko for Passkey support and BoxyHQ for SAML SSO. Resend and Unsend deliver transactional email via React Email components, and the platform exposes a Model Context Protocol endpoint for AI agent integration.

Code Quality No automated test files were found in the repository, which is a notable gap for a platform managing access control over sensitive documents and financial data. The TypeScript coverage is comprehensive and consistently applied: Prisma-generated types flow through API route handlers and SWR data-fetching hooks, and Zod schemas validate inputs at every API boundary. The lib/ directory is organized coherently by domain — tracking, tinybird, trigger, team, redis — and inline comments appear at moderate density, typically explaining non-obvious decisions like EU geo-detection routing, bot filtering logic, and edge config fallback behavior. ESLint and Prettier configurations are present at the root, and the project follows consistent Next.js file naming conventions throughout.

What Makes It Unique Papermark’s most technically distinctive feature is its per-page analytics pipeline: client-side timing events captured during document viewing are streamed to Tinybird’s columnar store via typed endpoints, enabling precise dwell time calculation per page across thousands of concurrent viewers without touching the transactional database. The combination of this analytics infrastructure with AI-powered Q&A conversations embedded directly in the dataroom viewer — using the Vercel AI SDK with OpenAI and Google Vertex — creates a document intelligence layer that goes beyond passive tracking. The addition of a Model Context Protocol server endpoint at /mcp for programmatic document management via AI agents, multi-region team-level storage routing, and dynamic per-viewer PDF watermarking at the rendering layer reflects an unusually forward-thinking integration philosophy for a document-sharing platform.

Self-Hosting

Papermark uses a split-license model. The core application code outside the ee/ and app/(ee)/ directories is released under the GNU Affero General Public License v3 (AGPLv3). AGPLv3 is a strong copyleft license: if you self-host Papermark as a network service and modify the source code, the AGPL requires you to publish those modifications under the same license. For most organizations using Papermark internally without distributing it externally, the practical compliance requirement is straightforward — run it, use it, and keep your infrastructure configuration private. Commercial use is permitted under AGPL, but combining it with proprietary software or distributing a closed derivative is where the license becomes restrictive.

The code in the ee/ directory is under a separate Papermark Commercial License, which explicitly requires a paid Commercial Subscription to use in production. These enterprise features — granular dataroom permissions, SAML SSO, AI Q&A conversations, workflow automation, dataroom invitations, and annotations — are included in the open repository for development and testing, but cannot legally be used in a production self-hosted deployment without a commercial agreement. Teams evaluating self-hosting should carefully assess which features they need: the AGPLv3 core covers document sharing, analytics, custom domains, email notifications, and basic data rooms, while the commercial tier adds the more advanced access control and automation capabilities. Running Papermark in production requires provisioning PostgreSQL, Redis, S3-compatible storage, a Tinybird account for analytics, Resend for email, and optionally Stripe if billing features are needed — a non-trivial infrastructure footprint that demands operational attention for updates, database migrations, and backup management.

Compared to the managed papermark.com cloud offering, self-hosters take on full responsibility for uptime, security patching, database backups, and scaling the PDF processing pipeline under load. The cloud plan includes data residency guarantees, SOC 2 compliance posture, managed upgrades to new versions with each release, and direct support access — trade-offs that matter most for teams sharing legally sensitive documents or operating under data privacy regulations. For teams with existing DevOps capacity and a preference for data sovereignty, the self-hosted path is viable, but it requires genuine infrastructure commitment beyond the initial setup.