{
 "slug": "paperless-ngx",
 "name": "Paperless-ngx",
 "tagline": "Document management system with OCR, tagging and full-text search",
 "category": "collaboration",
 "use_cases": [
  "document-management",
  "ocr",
  "paperless-office"
 ],
 "aliases": [
  "paperless"
 ],
 "status": "live",
 "upstream": {
  "vendor": "paperless-ngx contributors",
  "url": "https://docs.paperless-ngx.com",
  "license": "GPL-3.0",
  "license_url": "https://github.com/paperless-ngx/paperless-ngx/blob/main/LICENSE"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   80,
   443
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "live",
   "version": "3.3.4",
   "last_build": "2026-10-23",
   "entity_id": "prod-hbzumti35b7tu",
   "ami_alias": "/aws/service/marketplace/prod-hbzumti35b7tu/latest",
   "listing_url": "https://aws.amazon.com/marketplace/pp/prodview-wzyxaum3avpnc",
   "recommended_instance_type": "t3.medium",
   "price_usd_per_hour": 0.05,
   "free_trial_days": 5,
   "unit": "instance-hour"
  },
  "azure": {
   "status": "live",
   "version": "3.2.1",
   "last_build": "2026-10-03",
   "offer_id": "paperless-ngx",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:paperless-ngx:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.paperless-ngx?tab=Overview",
   "recommended_vm_size": "Standard_D4s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/paperless-ngx/",
  "json": "https://lynxroute.com/products/paperless-ngx/product.json"
 },
 "release_notes": [
  {
   "version": "3.3.4",
   "title": "Paperless-ngx 3.3.4",
   "notes": "* Paperless-ngx updated 3.2.1 -> 3.3.4. GPL-3.0 unchanged; database migrations run automatically\n* Security: GHSA-c8f3-pqr2-rr24 fixed, document-version permission fixes, and the certifi CA bundle updated to distrust the compromised eMudhra CA\n* New: barcode content search and two-factor authentication for the Django admin\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-23"
   }
  },
  {
   "version": "3.2.1",
   "title": "Paperless-ngx 3.2.1",
   "notes": "* Paperless-ngx updated 3.2.0 -> 3.2.1, a patch release. GPL-3.0 unchanged and no schema migration is added\n* OCRmyPDF updated to 17.12, fixing ligatures in the searchable text layer of OCR'd documents\n* The search index now rebuilds itself automatically when its Tantivy files are missing\n* Mail fetching uses a self-expiring lock, so a stale overlap check can no longer block mail rules from running\n* Optional AI / LLM / semantic-search features remain shipped DISABLED by default - no model downloads and no external calls; opt in with PAPERLESS_AI_ENABLED\n* Certbot pre-installed - enable HTTPS with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base to pick up the latest Ubuntu security updates\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-02",
    "azure": "2026-10-03"
   }
  },
  {
   "version": "3.2.0",
   "title": "Paperless-ngx 3.2.0",
   "notes": "* Paperless-ngx 3.2.0 on Ubuntu 24.04 LTS - feature update from 3.1.3. GPL-3.0 unchanged\n* Advanced search is parsed by a new Tantivy-backed query parser, with fuzzy and CJK terms matched in place; NLTK is no longer used, and PAPERLESS_ENABLE_NLTK and PAPERLESS_NLTK_DIR are retired\n* Correspondent, document type, storage path and tag matching gains a minimum match threshold (PAPERLESS_CLASSIFIER_MATCH_THRESHOLD) and a configurable regex timeout (PAPERLESS_MATCH_REGEX_TIMEOUT_SECONDS)\n* Adds central management of share links and share-link bundles, a duplicates filter, hide-able sidebar items, and an option to skip auto-suggestions for inbox documents\n* Document classifier training uses less memory and fewer queries, and bulk permission and custom-field edits are faster\n* Stricter validation on the bulk-edit, permissions and config APIs, plus fixes for mail workflows, the PDF editor and the bulk editor\n* Upgrading an existing instance runs one schema migration that indexes the archived-document checksum; first start takes longer on a large library\n* Optional AI / LLM / semantic-search features remain shipped DISABLED by default - no model downloads and no external calls; opt in with PAPERLESS_AI_ENABLED\n* Certbot pre-installed - enable HTTPS with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-20",
    "azure": "2026-09-21"
   }
  },
  {
   "version": "3.1.3",
   "title": "Paperless-ngx 3.1.3",
   "notes": "* Paperless-ngx 3.1.3 on Ubuntu 24.04 LTS - patch update from 3.1.1. GPL-3.0 unchanged\n* Security: 3.1.2 addresses GHSA-2jhj-xqrq-rmrq\n* Fixes filename generation using the root document's metadata, AI suggestions not always running after a document is created, failures when enqueuing files for consumption, and errors in the mail task chord\n* Interface fixes across the tasks page, the sidebar, dropdown wrapping and dark mode\n* Optional AI / LLM / semantic-search features remain shipped DISABLED by default - no model downloads and no external calls; opt in with PAPERLESS_AI_ENABLED\n* Certbot pre-installed - enable HTTPS with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-06",
    "azure": "2026-09-09"
   }
  },
  {
   "version": "3.1.1",
   "title": "Paperless-ngx v3.1.1-2",
   "notes": "* Re-release of Paperless-ngx 3.1.1. The application version is unchanged; this build fixes two defects in the image itself\n* Full-text search now indexes the first document you upload. Previously the first document on a new instance was stored and listed correctly but never entered the search index, so it could not be found by search until a manual reindex; every later document was indexed normally\n* Updates NLTK to 3.10.3, addressing CVE-2026-79675 (critical) and CVE-2026-78680\n* Optional AI / LLM / semantic-search features remain shipped DISABLED by default - no model downloads and no external calls; opt in with PAPERLESS_AI_ENABLED\n* Certbot pre-installed - enable HTTPS with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-02",
    "azure": "2026-09-03"
   }
  },
  {
   "version": "3.0.5",
   "title": "Paperless-ngx v3.0.5",
   "notes": "* Updated to Paperless-ngx 3.0.5 (patch on the 3.0.0 major release)\n* Search accepts the Whoosh-era abbreviated relative-date units again (yrs, mos, wks and similar), custom field values are validated in bulk operations, the AI suggestion cache is keyed by model and endpoint, and edit-dialog error change detection is fixed\n* New Tantivy full-text search backend replaces Whoosh - faster indexing and search\n* Optional AI / LLM / semantic-search features are included but shipped DISABLED by default - no model downloads and no external calls; opt in with PAPERLESS_AI_ENABLED\n* Document checksums now use SHA256\n* Legacy API v1 removed - use API v2 or later\n* Certbot pre-installed - enable HTTPS with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-git",
   "live": {
    "aws": "2026-08-18",
    "azure": "2026-08-19"
   }
  },
  {
   "version": "3.0.0",
   "title": "Paperless-ngx v3.0.0",
   "notes": "* Upgraded to Paperless-ngx 3.0.0 (major release)\n* New Tantivy full-text search backend replaces Whoosh - faster indexing and search\n* Optional AI / LLM / semantic-search features are included but shipped DISABLED by default - no model downloads and no external calls; opt in with PAPERLESS_AI_ENABLED\n* Document checksums now use SHA256\n* Legacy API v1 removed - use API v2 or later\n* Certbot pre-installed - enable HTTPS with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-git",
   "live": {
    "aws": "2026-07-24"
   }
  },
  {
   "version": "3.0.2",
   "title": "Paperless-ngx v3.0.2",
   "notes": "* Updated to Paperless-ngx 3.0.2 (patch on the 3.0.0 major release; fixes a broken 3.0.1 database migration - built fresh, so migrations run clean)\n* New Tantivy full-text search backend replaces Whoosh - faster indexing and search\n* Optional AI / LLM / semantic-search features are included but shipped DISABLED by default - no model downloads and no external calls; opt in with PAPERLESS_AI_ENABLED\n* Document checksums now use SHA256\n* Legacy API v1 removed - use API v2 or later\n* Certbot pre-installed - enable HTTPS with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-git",
   "live": {
    "aws": "2026-07-24",
    "azure": "2026-07-27"
   }
  },
  {
   "version": "2.20.15",
   "title": "Paperless-ngx 2.20.15 - Initial release (May 2026)",
   "notes": "* Paperless-ngx 2.20.15 on Ubuntu 24.04 LTS\n* Nginx TLS, first-boot credentials, PostgreSQL + Redis localhost-only\n* granian ASGI server, Celery workers, Tesseract OCR\n* CVE-scanned before release, SBOM (CycloneDX), CIS Report, IMDSv2 enforced\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-07-01",
    "azure": "2026-06-21"
   }
  }
 ],
 "release_history": [
  {
   "version": "3.3.4",
   "aws": "2026-10-23"
  },
  {
   "version": "3.2.1",
   "aws": "2026-10-02",
   "azure": "2026-10-03"
  },
  {
   "version": "3.2.0",
   "aws": "2026-09-20",
   "azure": "2026-09-21"
  },
  {
   "version": "3.1.3",
   "aws": "2026-09-06",
   "azure": "2026-09-09"
  },
  {
   "version": "3.1.1",
   "aws": "2026-09-02",
   "azure": "2026-09-03"
  },
  {
   "version": "3.0.5",
   "aws": "2026-08-18",
   "azure": "2026-08-19"
  },
  {
   "version": "3.0.2",
   "aws": "2026-07-24",
   "azure": "2026-07-27"
  },
  {
   "version": "3.0.0",
   "aws": "2026-07-24"
  },
  {
   "version": "2.20.15",
   "aws": "2026-07-01",
   "azure": "2026-06-21"
  }
 ],
 "deploy": {
  "aws_cli": "# subscribe once on the AWS Marketplace listing, then:\naws ec2 run-instances \\\n  --image-id resolve:ssm:/aws/service/marketplace/prod-hbzumti35b7tu/latest \\\n  --instance-type t3.medium --key-name my-key --security-group-ids sg-xxxxxxxx",
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer paperless-ngx --plan payg-gen2\naz vm create -g my-rg -n paperless-ngx --size Standard_D4s_v3 \\\n  --image lynxroute:paperless-ngx:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "Paperless-ngx is a self-hosted document management system that scans, OCRs and archives your paper trail into a fully searchable digital archive - a Django web application with a Celery worker for background OCR jobs, Redis for the task queue, and Tika + Gotenberg sidecars for parsing complex office documents. Documents are auto-classified into correspondents, document types and tags via a trainable Bayesian model; full-text search runs over the OCR output. The consume folder accepts uploads via the web UI, REST API, drag-and-drop, IMAP email ingestion and rsync drop. Persists documents, metadata and the search index in PostgreSQL with originals on the local filesystem. GPL-3.0 license - community-maintained fork of the original paperless project, no commercial vendor and no lock-in.",
  "image_adds": "Security hardening:\n* Admin credentials generated at first boot - unique per instance\n* Nginx reverse proxy with TLS - granian ASGI server bound to localhost only\n* PostgreSQL and Redis bound to 127.0.0.1 - no external DB exposure\n* UFW firewall - ports 22, 80, 443 only\n* fail2ban, IMDSv2 enforced\n* CVE scan - every image is scanned for vulnerabilities before release\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, SSH hardening, kernel hardening\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
 },
 "generated_at": "2026-10-31T09:36:34Z"
}