Draft for review. This page is written in plain language and has not yet been reviewed by a lawyer. We will update it if anything changes as a result.
Encryption
All traffic uses HTTPS. Stored files are kept in encrypted cloud storage.
Account protection
Sign in happens on OfficeBats, with optional two factor authentication. Sessions end when you sign out everywhere or change your password.
Designs and sharing
- Every request checks your role on the design: owner, editor, commenter or viewer.
- Share links are long random tokens and can be turned off at any time; open sessions lose access at once.
- Comment and edit links require sign in.
Uploads
- File types are checked from the file contents, not the name.
- Uploaded SVG files are cleaned of scripts, event handlers and external references before use.
- Uploaded fonts are checked before they are offered in the editor.
- User files are served with a sandbox policy, so they cannot run code on our site.
AI and website reading
AI is only available to signed in accounts. When a request names a website, our server only reads public addresses, checks every redirect, and limits size, time and content type.
Application security
Rate limits, cross site request checks, a strict content security policy and security headers protect every page. Exports are rendered in an isolated headless browser that can only load our own site and fonts.
Report a vulnerability
Email [email protected]. We appreciate responsible disclosure and will respond quickly.