Trust Center

How DeliverPage protects your documents and the people who view them. We’re an early-stage product, so this page is deliberately plain about what’s in place today and what’s still on the roadmap — rather than claiming certifications we don’t hold.

How your documents are protected

• Private storage: uploaded files are stored outside the public web root and are never reachable by a guessable URL — every request is checked against the document’s access rules before anything is served.
• Gated links, enforced server-side: passwords, one-time email verification, and NDA acceptance are all re-checked on every request, including the file-serving endpoint itself — a viewer can’t bypass a gate by reusing an old link or cookie.
• Signed session cookies: once a viewer passes a link’s gates, that state is stored in an HMAC-signed, HttpOnly cookie scoped to that link — it can’t be forged or reused on a different document.
• One-time codes are hashed, not stored: email verification codes are kept only as SHA-256 hashes. Even with direct database access, a plaintext code isn’t recoverable.
• View-only delivery: documents render in-browser with no download control and a dynamic watermark of the verified viewer’s email — a deterrent and a trace-back if a file is leaked, not unbreakable DRM.

Hosting & infrastructure

DeliverPage runs on WP Engine’s managed hosting, with all traffic served over HTTPS. Tenant data is isolated at the application layer — every query is scoped to the requesting tenant, so one organization’s documents, links, and analytics are never visible to another.

Certifications

DeliverPage does not currently hold SOC 2, ISO 27001, or similar third-party certifications. We’re a small, early-stage product and are building toward formal audits as we grow — this page will be updated when that changes.

GDPR & your data

See our Privacy Policy for the full detail on what we collect, why, and the rights available to you under GDPR and similar laws. In short: we collect only what’s needed to run the service (account details, document metadata, and gated-link view records), we don’t sell data, and you can request access to or deletion of your data at any time.

Report a security issue

If you believe you’ve found a security vulnerability in DeliverPage, please email [email protected] with details. We’ll acknowledge reports and work to address confirmed issues promptly.