Security
A short, honest account of the auth model, what's stored, and where — including the one gap we haven't closed yet.
Sign-in is passwordless: a one-time magic link sent to your email, valid for 15 minutes and single-use. There's no password to store, reuse across sites, or leak in a breach.
Each site has an owner, and can add editors and (Enterprise) approvers. The widget itself authenticates with a per-site API key or a per-member edit token — never a shared password. Every write is re-checked against your plan's permissions server-side, regardless of what the UI shows, so gating can't be bypassed by calling the API directly.
The hosted product runs on Cloudflare Workers with a D1 (SQLite-based) database per deployment — no long-lived servers to patch, edge-distributed by default. The self-hosted core, by contrast, is a single-tenant Node process with flat-file storage you run and control entirely yourself.
Every meaningful action — saves, publishes, rollbacks, submissions, approvals, rejections, invites, key rotations — is recorded with an actor and a timestamp, exportable as CSV or JSON.
Single sign-on (SSO) isn't implemented — we don't have a real identity provider to test it against yet, so rather than ship something half-working we're documenting it as a known gap. If SSO is a requirement for your team, talk to us before you commit to a rollout.