Application controls
Account and administrative actions require appropriate authorization. Access restrictions separate customer records and protect sensitive credentials. Account exports and legal requests are restricted to their intended users.
Safeguards include access controls, encrypted transport, destination validation, abuse prevention and incident handling. Infrastructure providers process network metadata needed to deliver and secure the service. These controls reduce risk; they are not a certification or a guarantee that incidents cannot occur.
Media, accounts and third parties
Uploaded creator media is public to anyone with its storage URL, even when a page is still a draft. Do not use the media library for confidential documents or sensitive records. Deleting a file removes the active stored object; independently cached copies may take longer to disappear.
Protect your email account because sign-in codes and links use it. Never share sign-in codes or secret API keys. External platforms, registrars and payment services operate their own systems. We cannot guarantee their availability, decisions or security.
Report a vulnerability or incident
Choose Security concern in the legal request form and provide the affected URL, impact and steps to reproduce without including other people’s private data or active credentials. Keep testing proportionate and within accounts and systems you are authorized to access. Do not disrupt service or extract customer data to demonstrate a flaw.
We assess reports, restrict access where appropriate, preserve necessary evidence and notify affected customers, people or authorities where required by applicable law. There is no automatic bounty programme.