Security and data
Your clients trust you with their files, texts and approvals. Here is exactly how they are protected.
- 1
One secret link per project, no password
Each client gets a unique link that can't be guessed (256 bits of randomness). We only keep a fingerprint of it: even we can't recover it. You can turn it off or replace it in one click.
- 2
Invisible pages
Client pages are not indexed by search engines, and their address is never passed on to the sites visited next.
- 3
Private files
Files are never public. Every view or download goes through a temporary link, valid for 60 seconds, issued after checking access.
- 4
Each agency in its own vault
Separation between accounts is enforced by the database itself, not just the interface. We check it with automated intrusion tests: reading, changing and downloading in another account are refused.
- 5
A team under control
Each member signs in with their own email, through a one-time sign-in link (no password to steal). Only the owner manages the team and the brand. Sensitive actions (sign-ins, invitations, links, deletions, exports) are written to a security log.
- 6
Encrypted in transit and at rest
Every connection uses HTTPS (encryption in transit). Data and files are encrypted at rest at our database provider (Supabase, in Ireland). Sensitive logins and passwords are additionally encrypted by the app before being stored.
- 7
Protected against abuse
Actions and uploads per link are rate-limited, executable files are refused, and every page applies strict browser security rules.
- 8
Your data stays yours
No ads, no trackers, never sold. You can export everything at any time (files and full history), and have everything deleted on request.
Hosting: Supabase (database and files) and Vercel (application).