256 AES encryption*

Here is how it works in detail (for the more technically inclined):
Paperless has the Mac OS system create an encrypted disc image (256 AES Encryption) that is a sparsebundle.
It then puts everything in the disc image.
It mounts and unmounts the disc image as required.
The password (if desired) can be stored in the keychain.
Paperless itself does not do anything with the encryption, it is a function of the Mac OS system.

Sparsebundle makes it more manageable for incremental backups as it doesn't have to backup the entire disc image.
(Backups outside of Paperless, i.e. Time Machine).

If the password is rejected, it isn't Paperless's fault, and there is no "back door".

Note: Be sure to remember your password or store it in your keychain!