Trust center

Last updated October 22, 2026

How AttachPage keeps your pages and data safe. AttachPage is run by JP Technology Services LLC. The details of what we store are in the privacy policy and the rules in the terms.

Hosting and encryption

• AttachPage runs entirely on Cloudflare: Workers for the service, D1 for account data and R2 for page files.
• All traffic uses HTTPS. Stored data is encrypted at rest by Cloudflare (AES-256).
• Sign-in links, sessions, personal page links, secret links, API keys and access tokens are stored only as keyed one-way hashes, so a copy of our database would not let anyone sign in or open a page.

Pages are kept apart and private

• Published pages are served from a separate domain (attach.page), one address per page, so a page's code cannot reach your AttachPage account.
• Pages are private by default. Each recipient gets a personal link, which is exchanged for a short-lived session on that page only. Ending access or removing someone takes effect on their next request.
• Secret links are 256-bit random codes, shown to the sender once and never emailed. They open the same way as personal links, and revoking one or letting it expire ends access on the next request.
• A sender can also ask for an email code: before the page opens, the person enters a 6-digit code sent only to the invited address. Codes work once, for 10 minutes, allow 5 tries and are stored only as hashes, so a forwarded link does not open the page.
• People a sender lets suggest changes or edit must be signed in with the invited address, so a forwarded invitation cannot be used to make changes. They cannot share, delete or change who can open the page, and every version they publish records who published it.
• Published pages are marked so search engines do not index them.
• The instant preview and paste checks run in your browser before anything is uploaded.

Sign-in and connected AI apps

• Sign-in is through Google or Microsoft. AttachPage never sees or stores your password.
• AI apps connect with OAuth 2.1: PKCE is required, tokens are tied to AttachPage, and refresh tokens are replaced on every use.
• The consent screen names the app and warns you when it is not a known app. You get an email when a new app connects, and you can disconnect it at any time.
• AI apps can only do what AttachPage's tools allow. Tools that email people or change pages are marked as actions, so apps like Claude and ChatGPT ask you before using them. Pages stay private unless you choose public.

Upload checks and abuse

• Uploads that contain secret keys, credential files, database dumps, executable files or password fields are refused.
• Limits on uploads, invitations and requests slow down misuse.
• New pages are screened daily by rules and an AI model running inside Cloudflare; a person reviews anything flagged. Anyone can report a page, and harmful pages and accounts are taken offline.
• Your content is not used to train AI models and is not sent to other AI companies.

Data retention

• Pages: until you delete them; files are removed within a day of deleting a page.
• Versions: each page keeps its 10 most recent; older ones are removed after 7 days.
• Pages published without an account: 48 hours unless claimed.
• Email records: 90 days. Expired sign-in links, sessions and codes: 30 days.
• Accounts: deleted within 30 days of a request to support@attachpage.com.

Service providers

• Cloudflare: hosting, storage, email sending, abuse-screening AI, document conversion, link-preview images.
• Google: sign-in (Identity Platform) and our support inbox (Workspace).
• Microsoft: sign-in, when you choose a Microsoft account.

No advertising, analytics or tracking services are used.

Report a security issue

Email support@attachpage.com with "Security" in the subject. We read every report, reply within a few business days, and ask that you give us a reasonable time to fix a problem before you share it. Please do not access other people's data or disrupt the service while testing. Our contact details are also at /.well-known/security.txt.