- If enterprise-grade compliance proof is required immediately
- If procurement requires SOC 2 Type II and/or ISO 27001 documentation available via a vendor trust center, Paper may not meet those requirements based on publicly documented information.
- If the workflow depends on mature collaboration conventions
- Teams that rely heavily on link-based sharing, granular commenting, robust branching/merging patterns, and well-established handoff workflows should consider more mature alternatives.
- If a full-featured design system workflow is required immediately
- Organizations that require reusable components in a Figma-like manner may find Paper insufficient until component features are delivered.
- If interactive prototyping in-tool is a primary need
- Paper appears oriented toward design-to-code rather than runtime interactive prototyping.
- If the organization is not prepared to operate an agent-driven workflow
- If an organization cannot manage the risks of agents writing into design files (permissions, review, reproducibility), the benefits of Paper’s agent integration may not be realized.
- Feature completeness gaps (community-reported)
- Core editing tools such as certain shape tools and commenting features have been reported as missing or delayed.
- Components and reusable primitives are requested by users and are under development without a publicly disclosed delivery timeline.
- MCP operational issues
- Documented troubleshooting patterns include long-running agent sessions causing errors, agents providing incorrect tool parameters, and limits not resetting after plan upgrades in some versions (vendor guidance recommends updating Paper Desktop and restarting).
- Platform limitations
- At least one user reported an inability to run the application on an Intel MacBook Pro; current platform compatibility should be validated against vendor download pages and release notes.
- Security/compliance transparency
- Privacy policy, Terms of Service, DPA, and subprocessors are published; however, certifications and deeper controls such as audit logs and SCIM are not clearly documented publicly.