Security

A short, honest overview of how we protect your data.

Your files

• Uploaded files and page images live in private storage. Nothing is publicly reachable by URL.
• Viewers see pages through signed links that expire shortly after they're issued.
• Deleting a document removes its files and turns off every link to it.

Accounts and access

• Sign-in is through Google; we never see your password.
• Every action checks that you belong to the workspace that owns the data. Database rules stop one workspace from reading another's data, and the app itself cannot change business data except through checked server actions.

Connected accounts

• Google Drive and Slack tokens are encrypted (AES-GCM) before storage and only used on our servers.
• Google Drive access is limited to files you pick.

Integrations and webhooks

• All traffic uses HTTPS.
• Messages from Slack and CloudConvert are checked against their signing secrets; unsigned requests are rejected.

Viewer privacy

We don't store viewer IP addresses or full browser identifiers, and we filter out bots and link scanners.

Reporting a problem

Found a security issue? Email admin@shlinko.com. We'll respond as quickly as we can.