Security

Your website password

• It is encrypted before it is stored, with a key that is not in the database. A copy of the database on its own does not open your site.
• It is decrypted at the moment it is used — to publish an article you approved — and never written to a log, an error message or a screen.
• For WordPress you give an application password, not your login. That is a separate credential you can revoke in your own admin at any time, without changing your password or affecting anything else.
• Every request to your site goes through an address check that refuses internal and private addresses, and re-checks every redirect. Your credentials cannot be sent somewhere they were not meant to go.

Your website itself

• Nothing publishes without your approval. There is no setting that turns that off, on any plan.
• Reading and grading your site changes nothing. The audit is read-only.
• Every edit to a live page is recorded and can be undone, including each internal link that was added.
• The same article cannot be published twice. If you press the button again, you get the existing link back rather than a duplicate post.

Your account and your content

• Passwords are hashed with argon2 — we cannot read yours, and neither can anyone who reaches the database.
• Workspaces are separated at the database level, not by a filter somebody has to remember to write. One customer’s query cannot return another customer’s rows.
• A password reset signs out every device, because a reset usually means somebody thinks their account was reached by someone else.
• Your drafts are yours. You can download every article as Word, HTML, Markdown or text at any time, with no ceremony.

The help desk

The instant answers are drawn only from our public help pages. The assistant has no access to accounts, drafts, credentials or any customer data — not as a rule it follows, but because none of it is ever put in front of it. It cannot tell you about another customer because it has never been shown one.

Found a problem?

Tell us through the help desk and mark it Technical. Open the help desk → Describe what you found and what you expected; you will get a person, not a form letter. Please do not test against the sites or accounts of other customers — report it and we will look.