Security and containment

ShareMyPage hosts arbitrary HTML, including pages that run their own JavaScript, which is what makes "ask an AI for a page and publish it" work. This page explains how that untrusted content is contained, and where your data lives.

How untrusted HTML is contained

A published page never runs on the app's own origin. Instead:

• It renders inside a sandboxed iframe, served from a separate, cookieless content origin, isolated from the dashboard around it.
• The sandbox is allow-scripts without allow-same-origin. That combination gives the page's JavaScript a null origin: it cannot read cookies or local storage, cannot reach the app that embeds it, and there is no login session on that origin to steal in the first place.
• Access control runs on the server before anything renders. A page you have not been granted is never sent to the browser.

The full sandbox attribute is:

allow-scripts allow-popups allow-forms allow-downloads
allow-popups-to-escape-sandbox allow-top-navigation-by-user-activation

Those extra tokens let legitimate things work, external links, mailto: and tel: actions, form posts, and downloads, while allow-same-origin stays deliberately absent so the page can never reach your account. Slide decks render under the same model.

Where your content is hosted

• In the EU. Page content, the database, and serverless compute all run in Frankfurt (eu-central-1 / fra1).
• US subprocessors are used only for authentication and payments, covered by the EU Standard Contractual Clauses.
• Encrypted in transit and at rest, with every database query scoped to your workspace for tenant isolation.

More

For the full picture, including identity, tenant isolation, and enterprise options (SSO/SAML, a signed DPA, customer-managed encryption keys), see the security overview.

See also

• FAQ for the short answer to "is it safe to host pages that run JavaScript?"
• Access and sharing for who can open a page in the first place.