Security

here.now hosts Sites (published web content, public or gated) and Drives (private file storage) for people and their agents. This page summarizes how we protect that content. For the legal terms, see our Terms, Privacy Policy, and Data Processing Agreement.

Encryption and secrets

• All traffic is served over HTTPS (TLS), including every site subdomain and custom domain.
• Files are stored in Cloudflare R2, which encrypts data at rest.
• Account variables (API secrets used by proxy routes) are encrypted at rest with a separate encryption key.
• Site passwords are stored as hashes. No one, including here.now, can read a password back — it can only be changed or removed.
• Access to production infrastructure is restricted to authorized personnel.

Access control

Every Site has an access mode, enforced at our serving edge before content is returned:

• Public — served to anyone. Personal site URLs are randomly generated and non-guessable; workspace label URLs are readable and should be treated as guessable.
• Password — served only after the visitor enters the shared password.
• Members-only — the default for workspace Sites. Served only to signed-in, active members of the owning workspace.
• Restricted — served only to viewers who verify an email address on the owner's allowlist.

Workspace membership checks are versioned: removing a member invalidates their access across all of the workspace's Sites promptly (typically within a minute), with no per-site cleanup required. Gated content is not served to crawlers or search engines.

Drives are private to your account and to accounts you explicitly share them with. Drive contents are never served at a public URL.

AI features and your content

We do not use your content to train AI models. The one place an AI model touches content is Site metadata generation: bounded excerpts from published files are sent to a third-party model (via OpenRouter, routing to Google) solely to generate titles, descriptions, and search metadata for your own dashboard and API surfaces.

• Workspace admins can turn this off for all of their workspace's Sites in workspace settings. When disabled, no content excerpts leave our infrastructure for any AI processing.
• Manually set titles and descriptions never involve an AI model, whether generation is on or off.
• Site thumbnails are screenshots rendered by Cloudflare's Browser Rendering service; no AI model is involved.

Authentication and API keys

• Sign-in is via emailed magic links / one-time codes or Google sign-in. There are no passwords to breach.
• Accounts can hold multiple named API keys, each individually revocable, so a leaked key can be rotated without disturbing others.
• Workspace roles are admin and member; only admins can manage members, invites, auto-join rules, and workspace settings. Every workspace must keep at least one admin.

Analytics and tracking

• We do not use tracking or advertising cookies. Our cookies exist only for sign-in sessions and site access gates.
• Owner-facing site analytics use privacy-preserving daily visitor hashes and coarse request metadata. Raw visitor IP addresses are not exposed to site owners.

Infrastructure and sub-processors

Our infrastructure is primarily US-based: Cloudflare (storage, serving, CDN), Railway (application hosting and database), Resend (transactional email), Stripe (payments), and OpenRouter/Google (AI metadata generation, only when enabled). The full sub-processor list, with change-notification commitments, is maintained in the DPA.

Data deletion

• Deleting a site permanently removes all of its files from storage.
• Deleting a workspace permanently deletes all of its Sites and files.
• Removing a workspace member revokes their access promptly; content they published for the workspace stays with the workspace.
• Closing an account deletes all of its sites and files.
• Anonymous (unclaimed) sites are automatically deleted after 24 hours.

Reporting a vulnerability

If you believe you have found a security issue in here.now, email hello@here.now with details and steps to reproduce. We will acknowledge your report and keep you informed as we investigate. Please do not access other users' data or degrade the service while testing.

Questions

Completing a security review or vendor assessment? Email hello@here.now and we'll help with questionnaires and any additional detail you need.