Built to earn your trust.
How ShareOut protects your credentials, your data, and what you publish — no marketing fluff, just what’s actually built.
Your credentials, protected
When you connect a third-party source — Google Sheets, Shopify, Snowflake, BigQuery, and more — the credentials are encrypted at rest with AES-256-GCM, using a unique random IV per record. The encryption key is stored as a platform secret; it is never in code or in the database.
Credentials never reach the browser. Every third-party API call goes through a server-side proxy that injects credentials on the server, checks the destination host, method, and path against an allowlist, and writes an audit entry — method, host, path, status, latency — for every call.
Locked down in transit
All traffic runs over TLS through Cloudflare. Session cookies are HttpOnly, Secure, and SameSite=Lax; admin sessions use the stricter SameSite=Strict.
No servers to patch
ShareOut runs on Cloudflare Workers, D1, R2, and Durable Objects — there’s no self-managed server stack to patch, harden, or leave exposed.
Governance for teams
Roles
Owner, admin, member — set who can do what in a workspace.
Publish approvals
Allow, prohibit, or require approval before content goes live — approvals are pinned to the exact content hash.
Audit log
Append-only workspace audit log, retained for one year.
Domain allowlist
Restrict workspace membership to your company’s email domain.
Every published page gets checked.
Every artifact published to the open web passes an AI moderation classifier before it goes live. Anything flagged is held private for human review — and if the classifier itself fails, we hold the content private rather than risk publishing something unchecked.
Your data doesn’t train the model
AI features call model providers through API-tier access — OpenAI, and Anthropic via the Vercel AI Gateway. We do not use your private workspace content to train public foundation models.
Subprocessors
| Provider | Purpose |
|---|---|
| Cloudflare | Infrastructure, global network |
| OpenAI | AI features |
| Anthropic (via Vercel AI Gateway) | AI features |
| Rebill | Payments |
Your data is yours
You own your content. Artifacts are standard HTML — nothing proprietary trapping you in. Everything is accessible through documented APIs, and you can export with one click. Your data is yours. Everything is exportable, nothing is held hostage.
Where we’re headed
SOC 2 Type II and regional data residency are on our roadmap — we’re not certified yet, and we’d rather say so than imply otherwise. Want more detail on our security architecture, or a DPA? Email security@shareout.site.
Found a vulnerability?
Report it to security@shareout.site. We read every report.