Security

Security and trust

What we do to keep your pages, comments and account safe, which companies handle your data, and, just as important, what we don't have yet. Last updated 14 November 2026.

In short

• Pages you share run on a separate domain, so a page's code can't reach your account.
• Passwords for staging sites are encrypted and never shown to anyone, you included.
• We never see your card details. Payments go through Dodo Payments.
• We don't store reviewers' IP addresses.
• Pages and their comments are deleted when their link expires or when you delete them.
• Our hosting providers, Cloudflare and Supabase, are independently audited. HTMLAnnotate itself doesn't have its own SOC 2 report yet.

Your pages

HTMLAnnotate runs on Cloudflare's network, and every page and request is served over HTTPS.

Pages you upload or import are served from their own domain, drop.htmlannotate.com, not from htmlannotate.com where your account lives. That keeps whatever code is inside a shared page away from your sign-in and your projects.

Each page has two links. The review link is the one you send: anyone with it can view the page and comment. The manage link carries a private key and lets its holder read every comment, reply and delete the page. Keep the manage link to yourself, the same way you would a password. Signed-in owners manage pages from their account instead.

You stay in control of who can comment. You can pause new comments on a page, mark comments Team only so reviewers never see them, and delete a page at any time.

Staging passwords

To review a staging site behind a browser password box, a signed-in owner types the site's login once. It is encrypted with AES-GCM using a key held as a server secret, stored next to the page with the same expiry, and only ever sent to that staging site itself. Reviewers never see it, and neither does the owner after saving it.

Accounts and sign-in

You sign in with Google or with a one-time code sent to your email. We never see or store a password for your HTMLAnnotate account. Sign-in is handled by Supabase.

Reviewers don't need an account at all. They give a name and email the first time they comment, so the page owner knows who said what.

Payments

Dodo Payments is our merchant of record. It collects your card and billing details on its own checkout and tells us only your plan, its status and a customer reference. Messages from Dodo Payments to our servers are signed, and we check the signature before changing any plan.

Spam and abuse

Uploads, imports and comments are checked with Cloudflare Turnstile, which tells people from bots without puzzles for most visitors. Our free tools and the MCP connector have usage limits per person and per day, and imports refuse private and internal network addresses so the importer can't be used to reach systems it shouldn't.

Your data and deletion

• How long pages last: 1 day without an account, up to 14 days on the free plan, and for as long as you keep them on Pro and Team.
• What happens at the end: when a link expires or you delete a page, the page, its comments, screenshots and technical details are deleted with it.
• Your account: write to us and we delete your account details within 30 days.
• What we collect and why: set out in full in our privacy policy.

Sub-processor list

These are the outside companies that process personal data for us. Each gets only what it needs for its job.

Cloudflare and Supabase each publish independent SOC 2 audit reports and other certifications for their own platforms; see Cloudflare's compliance resources and Supabase's security page. Those reports cover their infrastructure, not HTMLAnnotate's own processes.

What we don't have yet

We would rather tell you than have you find out later.

• No SOC 2 or ISO 27001 report of our own. We haven't been through an independent audit. If your company needs one before buying, write to us and we'll tell you honestly where we are.
• No single sign-on (SAML or SSO) and no custom data processing agreement template yet. Ask, and we'll see what we can do.
• No choice of data region. Our providers may store data outside your country, including in the United States.

Reporting a problem

If you think you've found a security problem, email hello@htmlannotate.com with "Security" in the subject. Tell us what you found and how to reproduce it, and please give us a chance to fix it before sharing it publicly. We'll reply as soon as we can and keep you updated. You can also see whether everything is running on our status page.