Data storage and access guide
Last reviewed: October 24, 2026
This guide explains where content uploaded to internalpage is stored, who can access it, and what deletion means. Use it to assess the service against your organization’s policies and the sensitivity of your material. For information about personal data collection and use, see our Privacy Policy.
Three things to know first
- Knowing a link does not grant access. A viewer must sign in and have permission to view the page.
- Uploaded files are stored in Cloudflare R2. Account and permission records are stored in a database on AWS. The service does not guarantee that all storage and processing remain in South Korea.
- Revoking access, setting an expiry, or deleting a page restricts subsequent viewing. These actions do not recall copies already received or immediately erase all originals and backups.
1. What is stored, and where?
On smaller screens, scroll horizontally to read the full table.
| Data | Storage or processing location | What to know |
|---|---|---|
| Uploaded HTML, Markdown, OpenAPI, and related files | Cloudflare R2 | Original sources and files needed for rendering are stored. Previous versions remain when a page is replaced. |
| Accounts, workspaces, page metadata, permissions, token hashes, access history, billing and support records | SQLite database on AWS Lightsail | The application server runs in the Seoul region. Temporary files may be created on the server during uploads. |
| Database backups | AWS S3 and a Cloudflare R2 backup bucket | Hourly S3 backups are active. An R2 replication bucket exists, but continuous database replication to R2 is currently disabled. Retention differs between backup types; see the deletion section below. |
| Product usage and acquisition analytics | PostHog | Public website, documentation, and app visits and events, device and referral information, and signed-in user and workspace context are used for analytics. The collection endpoint is in the United States. |
The production R2 content and backup buckets report an APAC (Asia-Pacific) location. This does not promise storage in a particular country. Cloudflare describes location hints as best-effort placement requests for performance, rather than country-specific residency guarantees. Page delivery also uses Cloudflare’s global network. Although the AWS application server and S3 backups are in the Seoul region, this does not mean that the entire service keeps data in South Korea. See Cloudflare’s R2 data location documentation for details.
Direct public access to the R2 buckets is disabled, and no public custom domains are attached directly to those buckets. The internalpage viewer checks permission before delivering content. Workspace custom viewer domains use the same authorization process. A custom viewer domain is different from exposing the storage bucket directly.
2. Who can view my pages?
When a page is requested, internalpage checks the email verified through Google sign-in and the page’s current permissions. Authorization also covers related images, CSS, JavaScript, and other files uploaded with the page.
On smaller screens, scroll horizontally to read the full table.
| Person | Access |
|---|---|
| Page owner or workspace owner | Can view, edit, and manage access to the page. A workspace owner can manage every page in that workspace. |
| Workspace member | Access depends on the page’s Workspace access setting. Editing also depends on the member’s role. |
| A Google account with an email matching the workspace’s company domain | Can view when Workspace access is Can view or Can edit. This can include same-domain accounts without a separate workspace membership record. |
| A person with an individual email grant | Can access pages allowed by User grants. Giving an external email viewing access does not grant workspace-wide management rights. Editing also requires membership in the page’s workspace. |
| Someone who only has the link | Cannot view without signing in and passing the page’s permission check. |
To share with specific people, set Workspace access to No access and grant access only to the required email addresses. The page owner and workspace owner retain their management rights. Review individual grants and workspace-wide access together: removing one route does not block access if another route still permits it. External sharing availability depends on the workspace’s plan.
3. Can internalpage operators access my content?
Personnel with system or storage administration privileges can technically access original content and service data. Page sharing permissions control access by other users. They do not remove operators’ server or cloud administration privileges.
internalpage does not provide end-to-end encryption in which only the customer holds the decryption keys. It also does not currently provide a feature for customers to approve every operator access in advance or inspect a complete record of all such access. The page access history shown in the app is not a comprehensive audit log of operator access to systems.
If your organization requires operator-access approval, a dedicated environment, a separate security agreement, or audit evidence, contact [email protected] before uploading content to confirm whether those requirements can be met. This guide does not replace agreed operational procedures or contractual commitments.
4. How is data protected, and what are the limits?
- Transport and storage: Public service endpoints use HTTPS. R2 encrypts stored objects using Cloudflare-managed keys. The current S3 backup bucket uses AES-256 encryption with AWS-managed keys. This does not mean that only the customer can read the data.
- Sign-in and tokens: Login sessions, personal API tokens, and OAuth tokens use hashes for authentication checks. Login session cookies use HttpOnly to prevent browser scripts from reading those cookies.
- Personal API tokens: These do not expire automatically. Grant only the scopes needed, and revoke tokens that are no longer used or have been exposed. The issuer’s current workspace permissions are also checked. See Token Handling.
- OAuth connection tokens: These are separate from personal API tokens. Access tokens expire after one hour and refresh tokens after 30 days. Revoking a connection causes later authentication through that connection to be rejected.
For details about storage encryption, see Cloudflare R2 data security and AWS S3 encryption with managed keys. These descriptions concern R2 objects and S3 backups. They do not imply customer-specific encryption keys for all data.
Limits once content reaches a browser
An authorized viewer can save, copy, or capture content received by their browser. The viewer does not prevent downloads or recall copies. Ordinary file responses allow browser caching for up to 60 seconds, so revoking access does not guarantee that an already open page or cached response disappears immediately.
Uploaded HTML is served as a web page. Embedded scripts can run, and external images, fonts, analytics code, and other resources can make network requests. The service does not make all HTML harmless or block external communication. The app and viewer use separate origins, but pages on the default viewer host do not each receive an independent security origin. Upload only files from trusted sources, and check external resources, personal data, and hidden secrets before publishing.
5. What happens when I revoke access or delete content?
On smaller screens, scroll horizontally to read the full table.
| Action | What changes | What to keep in mind |
|---|---|---|
| Remove an email grant or change Workspace access | Subsequent requests reaching the server are checked against the updated permissions. | Other permission routes, received copies, open pages, and browser caches are separate. |
| Set an expiry | The viewer stops serving the page after its expiry time. | Stored originals, previous versions, and backups are not deleted. |
| Delete a page | The page is marked deleted and viewer access is blocked. | This does not immediately erase page and version records or remote files. |
| Delete a workspace | A successful deletion removes its main workspace-scoped service records and locally stored files. | Remote R2 files are not automatically erased. Some account, connection, security, operational, billing, and backup records may remain. |
We do not currently guarantee that all originals, previous versions, and backups are fully erased within a fixed period. Completed objects in R2 currently have no automatic expiration rule. Hourly S3 database backups have a 14-day expiration rule, but that rule does not cover the latest backup and its previous versions, R2 backups, or every separate copy created during deployment. Previous versions of hourly backups also have a separate 14-day expiration condition. This is not a promise of full erasure within 14 days of the original backup’s creation.
The page access history interface shows up to 200 records from the last 30 days. Database access records older than 30 days are cleaned up when the API server starts. This is not a scheduled task that guarantees deletion on day 30.
If you need deletion that includes originals and backups, or a deletion deadline is a condition of adoption, contact [email protected] with the scope and required timing. Confirm what can be processed and which data or copies may remain before relying on the service. A support request alone is not a commitment to complete erasure by a particular deadline.
6. Is content sent to AI tools or other services?
Ordinary publishing and AI connections have different data flows
Publishing a file through the ordinary app, API, or CLI does not include a step that sends the source to an AI model for analysis. External tools used to create or publish a file handle data under their own policies.
When you connect a client such as ChatGPT or Claude through MCP (Model Context Protocol, a protocol for connecting models to tools), permitted tool calls can return page listings, descriptions, URLs, and source content to that client. In particular, the page-reading tool returns the current page’s complete original source after checking permission. The publishing tool stores the source sent by the client in internalpage. Connecting a client does not mean every page is automatically transferred, but the connected service receives responses to the tools it invokes.
Check that service’s retention and training practices for the product, plan, settings, and terms you use. internalpage page permissions do not control how an external AI service retains or uses information for training.
Other service providers
- Google: Verifies the sign-in email and profile. Google sign-in does not mean that your files are stored in Google Drive.
- Cloudflare and AWS: Provide file and service-data storage, application hosting, page delivery, and backups.
- PostHog: Processes usage analytics for the public website, documentation, and app, using cookies, local storage, and account and workspace context. The remote configuration for the project used by the web app and documentation also enables session replay and browser console recording. Page content, interactions, and console information may be collected; do not assume that collection is limited to anonymous visit counts or that all sensitive information is automatically masked. The internalpage viewer does not separately inject this analytics code into uploaded pages.
- Polar: Processes payments and subscriptions. Checkout can send names, email addresses, workspace information, and a customer IP address when present in the request.
- Discord: Processes configured operational notifications. These can include feedback text, email addresses, workspace context, and related page information.
The OpenAPI viewer loads rendering libraries from unpkg or jsDelivr. Uploaded HTML may also contain requests to external services. In those cases, the viewer’s browser connects to those services, and the data transmitted depends on the included code.
7. Is internalpage suitable for my organization’s material?
The table below provides review criteria, not approval to use an external service on your organization’s behalf. Assess the sensitivity of your material against your own policies.
On smaller screens, scroll horizontally to read the full table.
| Example material | Before uploading |
|---|---|
| Public documents or demos using synthetic data | Review recipients, external code, and personal information included in the files. |
| General internal guides or de-identified reports | Check your external-service policy and access by workspace owners and same-domain accounts. |
| Confidential business plans, customer-specific material, or real operational data | Review operator access, international processing, original and backup deletion conditions, required agreements, and organizational approval first. |
| Passwords, API secrets, highly sensitive personal information, or regulated data | Remove them from files. Do not upload them without separate written approval and the necessary safeguards in place. |
Do not assume that the current standard service meets requirements for country-restricted storage, customer-only decryption, download prevention, or a guaranteed deadline for erasing every copy. A cloud provider’s certification is not a certification of internalpage itself. Contact [email protected] about certification evidence, audit materials, or contractual requirements for your security review.
This guide describes the implementation and operational settings checked on the review date above. It is not an audit report guaranteeing individual server-access approval procedures, a complete record of operator access, or successful backup restoration. For related information, see Sharing Model, Token Handling, and our Privacy Policy.