Document management system with OCR, tagging and full-text search
CIS Level 1 hardened Ubuntu 24.04 LTS image by Lynxroute · unique credentials at first boot · CVE-scanned · SBOM and CIS report inside
| Cloud | Version | Software price | Last build | |
|---|---|---|---|---|
| AWS Marketplace EC2 AMI · all commercial regions | 3.3.4 | $0.05/hr Recommended instance: t3.medium · 5-day free trial | 2026-10-23 | Listing ↗ |
| Azure Marketplace VM image · plan payg-gen2 · Gen2 | 3.2.1 | $0.028/vCPU/hr Recommended VM: Standard_D4s_v3 | 2026-10-03 | Listing ↗ |
Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.
| Base OS | Ubuntu 24.04 LTS |
| Hardening | CIS Level 1, Ubuntu 24.04 LTS (tailored) |
| License | GPL-3.0 |
| Upstream | paperless-ngx contributors |
| Machine-readable | product.json · catalog.json |
Paperless-ngx is a self-hosted document management system that scans, OCRs and archives your paper trail into a fully searchable digital archive - a Django web application with a Celery worker for background OCR jobs, Redis for the task queue, and Tika + Gotenberg sidecars for parsing complex office documents. Documents are auto-classified into correspondents, document types and tags via a trainable Bayesian model; full-text search runs over the OCR output. The consume folder accepts uploads via the web UI, REST API, drag-and-drop, IMAP email ingestion and rsync drop. Persists documents, metadata and the search index in PostgreSQL with originals on the local filesystem. GPL-3.0 license - community-maintained fork of the original paperless project, no commercial vendor and no lock-in.
Security hardening:
OS hardening (CIS Level 1):
Compliance artifacts:
Credentials are generated at first boot and written to /root/paperless-ngx-credentials.txt.
# subscribe once on the AWS Marketplace listing, then:
aws ec2 run-instances \
--image-id resolve:ssm:/aws/service/marketplace/prod-hbzumti35b7tu/latest \
--instance-type t3.medium --key-name my-key --security-group-ids sg-xxxxxxxx# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer paperless-ngx --plan payg-gen2
az vm create -g my-rg -n paperless-ngx --size Standard_D4s_v3 \
--image lynxroute:paperless-ngx:payg-gen2:latest --admin-username azureuser --generate-ssh-keys
The most recent release with notes; the full release history is in product.json.