Private work should stay private.

Current safeguards

• Every client review is protected by its own password.
• Passwords are stored as salted, computationally expensive hashes—not plain text.
• Owner and reviewer sessions use secure, HTTP-only cookies in production.
• Uploaded HTML renders inside a sandboxed iframe.
• Production traffic is served over HTTPS with strict transport security.
• Repeated password attempts are rate limited.
• Private owner and review routes are excluded from search indexing.

Data handling

Finalpass stores the HTML, reviewer names, comments and decisions required to provide the service. It does not ask client reviewers for an email address.

Responsible use

Do not upload secrets, live customer lists or regulated personal data inside email HTML. Finalpass is a review tool, not a secure document vault.

This page describes the current product and will be updated as infrastructure and account features develop.