Security & data

What we store, who can open it

Secure Publish is operated by SecurePublish. This page is the straight version of what happens to the HTML you publish — no encryption theater, no compliance badges.

Where the HTML lives

The HTML your agent or the CLI publishes is stored on Cloudflare, in Workers KV. That is our service holding the file. The people who operate Secure Publish can technically read that content. We do not promise encryption that would hide it from the operator.

Who can open a panel

A published link only opens for someone who both signs in and is on that panel’s access list: everyone at your company's domain, or only the people from your company you listed. Without that session, the URL does not return the HTML.

How long it stays

It stays until you delete it. Usually it stops opening within about a minute.

How to delete

Delete from the CLI or from the console. Both use the account you signed in with.

What we record

We store the email of who published each panel and the email of each person who opened one, with the date of their first and last access. The publisher sees that under Who viewed. We also store how many times each panel was opened, and a short event log of first-time events tied to a hashed email (first account, first publish, first colleague opening a panel). We also keep short-lived counters of IP addresses and of wrong login codes, together with the account email (some hashed), for up to 48 hours, only to slow down abuse.

Login by code

When you sign in from the CLI, the code appears in your own terminal. Type it only at app.securepublish.work/device, after you sign in yourself.

We never ask for that code by email, chat, or phone. If someone sends you a code, don’t type it.

Security and data removal contact