Security
Let your client in. Keep your site safe.
What Siteshare does so a client can change your site without being able to break it, and so your code stays yours. In plain words, as it works today.
Your site
Each site runs alone.
A sandbox per site
Every site runs in a container of its own. Nothing in it reaches another site, the platform's database or its keys.
No keys in the sandbox
The sandbox holds no secret of the platform: no sign-in keys, no key to the AI model, no access to GitHub.
Almost no internet
Code from your repository can only read from the package registries and font services a build needs. Everything else is refused.
Nothing taken on trust
Whatever comes out of the sandbox, paths, file counts and sizes, is checked again by the platform.
The assistant
It can only touch the site's own files.
Inside the site's folder
The assistant reads and changes files of that site only, and follows no link out of it. It never reads files with secrets, like .env.
Protected parts stay protected
What a client may change is checked by the platform when the change is saved and again at Publish, on the change itself, not on what the assistant says it did.
Text that tries to steer it
Words on a page or in a photo can't give the assistant new rights. Its limits are enforced, not asked for.
Your repository
Your main branch, your host.
Through a GitHub App
Access only to the repositories you choose: write contents, read checks and metadata. Nothing else.
One commit per publish
Nothing reaches main that didn't build on a clean copy first. No force pushes; Restore is a new commit, never a rewrite.
We don't host
Your host keeps deploying main as always. If Siteshare were gone tomorrow, your site would not notice.
Signing in
No passwords to steal.
A code by mail
Or GitHub and Google. An address that isn't invited gets nothing, and the screen looks the same either way.
Two-factor authentication
With an authenticator app and recovery codes, for anyone who wants it. A team's owner can require it for every builder; a client is never forced.
Every device in sight
Each sign-in is kept with its device and place. In your profile you see them all, sign out any one of them, and read your own log.
Cookies only we can touch
Set and read only by our own pages, so a script on a preview can't reach them.
Limits on trying
A mail per minute per address, five tries per code, ten wrong codes an hour, and a limit per person on everything that changes something.
Your data
Content stays in your repository.
What we keep
Names, email addresses and a log of who did what, kept for a year. Photos your client uploads for 7 days, pictures of a page for 30 days.
What we never keep
Your site's content: that lives in your repository. The assistant's conversations stay in the site's sandbox; we don't store them anywhere else.
Who helps us run it
Cloudflare (hosting, sandboxes, storage), GitHub, Anthropic (the AI model), Resend (mail) and Stripe (payments).
Found something?
Tell us, and we'll look at it right away.
If you think you found a security problem, get in touch. Please give us the chance to fix it before you share it.
Hand it over. Get your evenings back.
Free for one site, forever. No card needed.