GDPR check

Is Papers (ReadCube) GDPR compliant? What universities should check

Papers, the reference manager from Digital Science, is now sold under the ReadCube name. This page sets out what Digital Science publicly documents about hosting, subprocessors, transfers, AI features and plan tiers, and what that means for a university choosing or reviewing it.

Published 7 October 2026 · Sources checked 7 October 2026

Short answer

Papers is now part of ReadCube. Both are run by Digital Science & Research Solutions Inc., a US company in the Digital Science group. Libraries and files are stored with Amazon Web Services in the United States. OpenAI is a listed subprocessor for the AI features, and the terms say Digital Science will not use your inputs for its own training. Digital Science is an active participant in the EU-U.S. Data Privacy Framework and publishes a group data processing addendum that applies where a contract incorporates it. Self-serve plans are bought by individuals; Enterprise adds single sign-on and admin controls. For a university, the plan tier decides who holds the contract and who controls the data.

Prefer a tool built in the EU? Kahubi, from Avidemic AB in Sweden, covers reference management and a research library with EU hosting and, for institutions, only European subprocessors. See how Kahubi handles research data

What Digital Science documents publicly

Everything in this table comes from ReadCube's and Digital Science's own pages or the official Data Privacy Framework list, read on 7 October 2026. Numbers in brackets refer to the sources at the end of the page.

Topic	What the vendor states	Source
Product and company	ReadCube is operated by Digital Science & Research Solutions Inc., a Delaware corporation in Cambridge, Massachusetts. European contacts go to Digital Science's London office. Papers plans have become ReadCube plans: Essentials ("Formerly Papers Essentials") and Plus ("Formerly Papers Pro").	[1] [2]
Desktop versus cloud	ReadCube Papers is a synced service: plans include PDF storage and "Sync across multiple devices". The security statement recommends keeping local copies of important files.	[2] [3]
Where data is stored	"ReadCube Papers uses Amazon Web App Hosting Services (AWS) for data storage", and the subprocessor list shows AWS in the US for hosting. The privacy policy says "much of the ReadCube infrastructure" is in the United States. Not found publicly An EU hosting option, although the group DPA mentions that a contract may fix a storage region.	[1] [3] [4] [6]
Subprocessors	Documented Group affiliates in the UK, Romania and Germany. Third parties, all in the US: Freshworks (support), AWS (hosting), Peaberry Software (usage analytics and marketing messaging), Twilio (transactional messaging), Delighted (NPS), SolarWinds (logs), Get Full Text Research (access checks) and OpenAI (language models). List last updated 26 March 2025.	[4]
Data processing agreement	Contract-dependent Digital Science publishes a group DPA (January 2023) that applies to agreements which expressly incorporate it, with the 2021 SCCs. The ReadCube terms say an organisation's separate contract prevails. A DPA for self-serve plans was not found publicly (checked 7 October 2026).	[5] [6]
International transfers	Documented Active participant in the EU-U.S. DPF and the UK Extension (non-HR data) on the official list, matching the DPF notice in the privacy policy. The group DPA incorporates the 2021 SCCs.	[1] [6] [7]
AI features and training	All plans include AI chat with PDFs; higher plans add chat with a whole library and, on Enterprise, a Research Assistant. The terms say user content may be used as input to generate outputs, and "We will not use your inputs for our own training purposes".	[2] [4] [5]
Organisation access	With an organisation's subscription, the organisation may have admin rights including access to the contents of a user's library. If a user signs up for a free account with an organisational email address, the organisation's representatives may see the email address and usage statistics.	[1] [5]
Retention and deletion	Personal data is kept only as long as necessary and then destroyed, erased or anonymised. No specific periods were found publicly. AWS keeps redundant backups across multiple locations.	[1] [3]
Security certifications	Documented Digital Science lists ReadCube within the scope of its ISO/IEC 27001:2022 certificate, valid until January 2029. Its ISO/IEC 27701 certificate covers group operations and Dimensions, not ReadCube.	[8]
Institution controls	Plan-dependent Enterprise ("Formerly ReadCube Pro") adds single sign-on and group management, an admin dashboard and advanced user management.	[2]

Digital Science deserves credit for a public subprocessor list that names its AI provider and gives a location for every entry, a clear contractual statement that inputs are not used for its own training, an independently certified ISO 27001 scope that names ReadCube, and a long-standing DPF certification backed by a published notice. Being open about what organisations can see in a user's library is also helpful for transparency to staff and students.

What this means for research and teaching

Validemic's analysis

The plan decides the relationship. A researcher who buys Essentials or Plus with a credit card is Digital Science's customer, and Digital Science is the controller of their account data. The university has no contract and no DPA. An Enterprise agreement can bring in Digital Science's DPA and make the university the controller, with Digital Science as processor under Article 28 GDPR [9]. If a department pays for a team, make sure the order form actually incorporates the DPA.

The OpenAI subprocessor. AI chat sends parts of the user's PDFs to OpenAI in the United States. Digital Science commits not to use inputs for its own training, but the terms we read do not describe OpenAI's retention for this service. For published papers this matters little. For unpublished manuscripts, peer-review copies or confidential reports, it matters a lot.

Transfers. With US hosting and US subprocessors, transfers are routine. Digital Science's active DPF certification gives a route for EU data, and the European Commission's adequacy decision of 10 July 2023 lets data flow to certified US companies [10]. The group DPA adds SCCs where a contract incorporates it.

Organisational visibility. Staff should know that, under an organisation's subscription, admins may access the contents of their library [1] [5]. Say so in your internal privacy notice, and set an admin access policy.

Sensitive content and DPIA. Participant data and other special category data under Article 9 GDPR [9] do not belong in a reference library. An institution-wide Enterprise rollout with AI features over full-text libraries is a reason to run a DPIA screening under Article 35. Try our DPIA screening tool.

Reviewing a vendor right now? Validemic checks the vendor's documents against GDPR and the EU AI Act and cites every finding. Try the demo workspace

Questions to ask Digital Science before approving it

Will our Enterprise order form incorporate the Digital Science DPA, and is there a more recent version than January 2023?
Can our institution's data be stored in an EU region, as the DPA suggests a contract can provide?
What does OpenAI retain from AI requests, and under which agreement with Digital Science?
Can admins switch AI features off for all users, or for specific groups?
When and how do you notify customers of subprocessor changes?
How long are a user's library and files kept after an account is closed or a subscription lapses, including backups?
Under what conditions can our admins view the contents of a user's library, and is that access logged?
Is ReadCube planned for inclusion in the scope of your ISO/IEC 27701 certificate?

An EU-built option

Looking for a European tool for reference management and a research library?

Kahubi is an AI research workspace built by Avidemic AB, a company registered in Sweden. Researchers use it to import their library through Zotero sync, BibTeX or RIS, read and question their papers, and cite them in the manuscript in their own citation style.

Runs on servers in the European Union, under EU law end to end
Your papers, data and recordings are never used to train AI models
For institutional customers, every subprocessor is a European company processing data in the EU

Explore Kahubi See Kahubi's subprocessors

Disclosure: Kahubi and Validemic are both built by Avidemic AB. Assess any tool, ours included, against your own institution's requirements.

The EU AI Act angle

Chatting with papers, comparing articles and building literature searches are research aids, not one of the high-risk education uses in Annex III (admission, evaluating learning outcomes, assessing the level of education, or monitoring students during tests) [11]. Those obligations now apply from 2 December 2027 under the amended Article 113 [12]. Article 4 on AI literacy, as amended, asks deployers to take measures to support the AI literacy of their staff [13]. ReadCube's own terms say AI outputs may be incorrect and need human review [5], which is a useful starting point for staff guidance.

Sources

ReadCube Privacy Policy, including Data Privacy Framework Notice, last updated 19 March 2026, retrieved 7 October 2026
ReadCube Pricing, retrieved 7 October 2026
ReadCube Security Statement, retrieved 7 October 2026
ReadCube Data Protection (sub-processors), last updated 26 March 2025, retrieved 7 October 2026
ReadCube Terms of Use, last updated 24 March 2025, retrieved 7 October 2026
Digital Science Data Processing Addendum (PDF), last updated January 2023, retrieved 7 October 2026
Data Privacy Framework List, entry for Digital Science & Research Solutions Inc., retrieved 7 October 2026
Digital Science security certifications, retrieved 7 October 2026
Regulation (EU) 2016/679 (GDPR), Articles 9, 28 and 35, text read from the Publications Office copy, retrieved 7 October 2026
EU-US data transfers, European Commission, retrieved 7 October 2026
AI Act Annex III: High-risk AI systems, AI Act Service Desk, retrieved 7 October 2026
AI Act Article 113: Entry into force and application, AI Act Service Desk (as amended by Regulation (EU) 2026/1744), retrieved 7 October 2026
AI Act Article 4: AI literacy, AI Act Service Desk, retrieved 7 October 2026

About this page

We read ReadCube's privacy policy, terms, pricing page, security statement and subprocessor list, Digital Science's DPA and certification page, and the European Commission's page on EU-US transfers on 7 October 2026, and checked the official Data Privacy Framework list through its public search interface on the same day. Some pages were read through a text-rendering proxy because they load content with scripts. "Not found" means we could not find the information in public documentation; it does not mean Digital Science lacks it, and an Enterprise contract may say more.

This page is not legal advice and does not say whether any particular use of Papers or ReadCube complies with the GDPR. If you work for Digital Science and see an error, please contact us and we will correct it.

Frequently asked questions

What happened to Papers?

Papers is now part of ReadCube, also from Digital Science. ReadCube's pricing page says its Essentials plan was formerly Papers Essentials and its Plus plan was formerly Papers Pro, and papersapp.com now redirects to ReadCube. Digital Science's privacy policy and security statement refer to the product as ReadCube Papers.

Is Papers GDPR compliant?

No tool is GDPR compliant on its own. Digital Science publishes a privacy policy written with European data protection law in mind, a subprocessor list and a Data Privacy Framework notice, and it is an active DPF participant. Whether a university's use complies depends on the plan, any institutional contract and what users store.

Where does ReadCube Papers store data?

Digital Science's security statement says ReadCube Papers uses Amazon Web Services for data storage, and its subprocessor list shows AWS in the United States for hosting. The privacy policy says much of the ReadCube infrastructure is based in the United States.

Does ReadCube use my papers to train AI?

The ReadCube terms say user content may be used as input to generate outputs for AI features, and that Digital Science will not use your inputs for its own training purposes. OpenAI is listed as a subprocessor for language models.

Is Digital Science on the Data Privacy Framework list?

Yes. On 7 October 2026 the official DPF list showed Digital Science & Research Solutions Inc. as an active participant under the EU-U.S. DPF and the UK Extension for non-HR data. No Swiss-U.S. DPF certification was shown.