Security & privacy
Your client deck stays private, not searchable on Google.
noindex by defaultisolated content planePBKDF2 passwordsno AI trainingno data sellingSOC 2 Type II-ready infrastructure on Cloudflare
Noindex by default
It won’t show up on Google
Every page ships with a robots meta tag and an X-Robots-Tag: noindex, nofollow response header, the two signals search engines use to decide whether to list and follow a URL. Both say no by default, so your client deck stays out of search results. You can opt a page into indexing only if you explicitly choose to.
Illustrative demonstration of default behaviour. No real customer data.
Isolated content plane
Your pages are walled off from your account
Published pages serve from a separate content plane (Pagelive’s own content domains, and your own custom domain with Solo) that’s isolated from the control plane where your dashboard, login, and billing live. A served page can’t reach your account data. If a page were ever compromised, the blast radius stops at that page.
- • Dashboard
- • Auth & accounts
- • Billing
- • Your published pages
- • Custom domains (Solo)
- • noindex · edge-gated
Password protection
Lock a page with a password even we can’t read
On Solo and Team, any page can be password-protected. The password is PBKDF2-hashed, never stored in plaintext, and not visible to us. The gate is enforced at the edge with signed cookies, so only people who have both the link and the password can open the page. Lose the password? You reset it; we can’t recover the original because we never had it.
Hashed, not stored
PBKDF2-hashed at rest, never plaintext, never visible to us.
Edge-gated
The check runs at the edge before any content is served.
Signed cookies
A verified visitor gets a signed cookie. No shared secret leaks to the page.
What we never do
No training on your content · no selling your data
We never use your content, or anything inside your pages, to train AI or ML models, ours or anyone else’s. Your work is yours.
We never sell your data, and we never sell or rent the email addresses of the people you share pages with. Read the privacy policy →
And we never delete your evidence. Analytics are recorded from day one and never deleted behind a paywall: the full detail for every page keeps accumulating whatever plan you are on, and upgrading unlocks the whole history, back to day one.
Infrastructure
On SOC 2 Type II-ready infrastructure
Pagelive runs entirely on Cloudflare (Workers, D1, and R2): SOC 2 Type II-ready infrastructure. That means DDoS protection, TLS everywhere with automatic per-domain certificates, and your data on a hardened, globally distributed network.
For the security lead reviewing this
No. We never use your content, or anything in your pages, to train AI or ML models, our own or anyone else’s. It’s in our terms.
Entirely on Cloudflare (Workers, R2, and D1): SOC 2 Type II-ready infrastructure. Your pages serve from an isolated content plane that’s walled off from the dashboard, auth, and billing.
No, pages are noindex by default. We send a robots meta tag plus an X-Robots-Tag: noindex, nofollow header that tells search engines not to list or follow it. You can opt a page into indexing only if you explicitly choose to.
Anyone with the link can open a page unless you add a gate. On Solo and Team you can add a password, a verified email (a one-time code, or Google sign-in), a list of allowed addresses or company domains, or make it view once. Recipient links tell you who opened a page; they do not block anyone. Passwords are PBKDF2-hashed, never stored in plaintext, and we can’t see them. The gate is enforced at the edge with signed cookies, so only people who pass it can open the page.
Nobody, until the owner switches comments on for that page (Solo and Team). Then only readers who can be identified: people who verified their email with a one-time code or Google, or opened their own recipient link. The sign-in lives in the bar above the page, never inside the published page, and the owner can keep internal notes that no reader ever sees.
No. We never sell your data, and we never sell or rent your recipients’ email addresses. See our privacy policy for the full picture.
No. Pagelive serves your live HTML page: animations, responsive layout, and interactive elements all keep working. Nothing is flattened into a static image.
The questions a CTO actually asks before a confidential document goes out, answered plainly.
Privacy
How we handle viewer data, and a clear takedown path
Analytics are privacy-first: viewer IPs are salted-hashed, never stored raw, with coarse country only. If a page ever needs to come down, abuse and takedown requests have a clear path and we can disable a page from the edge with one flip.