TRUST

Security

Last updated: 26 October 2026

Your pages and documents are your clients’ business. Here is how UnveilPage looks after them, plainly, including what we don’t have yet.

Where your data lives

UnveilPage runs on Cloudflare. The database and the files you upload are stored in the EU, using Cloudflare’s EU jurisdiction for its database (D1) and storage (R2). Pages are served from Cloudflare’s network close to whoever opens them. Who else handles data, and why, is listed in our data processing agreement.

Encryption

• Everything is served over HTTPS, and browsers are told to use nothing else (HSTS).
• Documents sent for signature are encrypted with their own key (AES-GCM). That key is itself encrypted with a master key kept as a server secret, so a copy of the storage alone can’t be read. “Destroy everything” deletes the key, which makes every copy unreadable.
• Signers’ IP addresses, kept as evidence of a signature, are encrypted with the document. Webhook addresses and secrets are encrypted too.

Less data to begin with

• For visits to shared pages we never store IP addresses, only salted scrambles of them, different for every link.
• Reading insights and the per-link cookie only start once the reader chooses Allow.
• Visit details are deleted after 24 months, or sooner if you choose. You can download everything, or delete your workspace or account, in Settings.

Shared pages are kept apart

Shared pages run in a browser sandbox with its own origin and a strict content security policy, so a page can’t reach your account or another customer’s. (On your own domain you can switch the sandbox off for a page that needs it.) Pages on the Free plan can’t contain password fields or forms that send to other sites, and any page can be reported, from the page itself or at unveilpage.com/report.

Signing in

• No passwords to steal: you sign in with Google, or with a one-time code we email you. Codes expire in 10 minutes, and we only keep a hash of them.
• A bot check (Cloudflare Turnstile) guards sign-in. Session cookies are HttpOnly and Secure, and every change in the dashboard needs a header other sites can’t send.
• API keys and connected AI apps stop working the moment the person who made them leaves the workspace or is suspended.

Our own access

Our admin tools show accounts, counts and sizes, never your pages, recipients, comments or documents, and there’s no “log in as you”. The one exception is a page someone reports for abuse. Every look and change by our staff is logged with a reason, and you can read the log under Settings → Staff access.

Backups

The database can be restored to any point in the last 30 days. When you delete something, it’s gone from the live service at once and drops out of these backups within 30 days.

What we don’t have yet

UnveilPage is in beta. We don’t yet hold certifications such as SOC 2 or ISO 27001, and we haven’t had an outside penetration test. Each feature has been through our own security review before release.

Found a problem?

Please tell us at hello@unveilpage.com (put “Security” in the subject) and give us a chance to fix it before sharing it. We reply within a few working days, and we won’t take action against good-faith research that respects people’s data. To report a page, use the Report link on it, or unveilpage.com/report.