# Security

Last updated July 18, 2026

**Short version:** your document is isolated from every other document on the platform, encrypted while it travels over the network, encrypted at rest by Cloudflare, and protected by per-document permissions, link settings, unguessable tokens where used, and authenticated owner checks. We don't sell document data, run ads, or train Comment.io models on it. Voice Notes beta keeps recordings on the Android device in the current mobile path, transcribes on-device when the speech pack is ready, uses BYOK Deepgram or AssemblyAI only when configured or chosen, and lets you opt into a cleanup Botlet that can process saved transcript documents. Security reports go to [max@comment.io](mailto:max@comment.io) and are reviewed promptly.

Your documents are isolated from every other document on the platform, encrypted on the way to us and while we hold them, and controlled by each document's sharing settings. New normal documents are shareable to anyone with the link by default so collaborators and agents can join quickly; owners can restrict access from the Share menu at any time. This page explains what that means, what we do with the data you give us, and what we don't. If you're trying to decide whether to put a draft, a memo, or your team's notes here — this is for you.

**Isolated by document**
Each document gets its own private container with storage no other document can reach.

**Encrypted in transit**
Browser, live-collaboration, and API traffic uses HTTPS/TLS.

**Encrypted at rest**
Cloudflare-managed storage encrypts persisted values and uploaded images.

**Permission-gated access**
Private or restricted documents require a valid token, signed-in owner, or explicit permission grant.

## Core commitments

- **Your documents are yours.** We use document content only to provide the editor, collaboration, comments, suggestions, authorship history, storage, and API features you ask us to provide.

- **No ads, no data brokers.** We don't sell, rent, or share document content with advertisers or data brokers — there's no one to sell it to.

- **No model training by Comment.io.** We don't train AI models on your documents or voice notes. If you choose to give a third-party agent, hosted Botlet, OpenAI/ChatGPT connection, Transcript Cleanup Botlet, or Voice Notes beta provider access to content, that provider or runtime's own terms apply to what it receives.

- **Hashed secrets at rest.** If our database leaked tomorrow, the secrets in it would be useless. Agent API keys are stored as one-way hashes — even we can't read the original — and sessions are signed so a copy of a database row can't be used to log in as you.

- **Clear security contact.** If you find a security bug, email [max@comment.io](mailto:max@comment.io). Good-faith reports are triaged promptly, and reproduction happens on test documents rather than user data.

## What we don't do, and what we can see

**Can Comment.io operators read your documents?** Operational access to production storage exists for incident response and bug investigation — that's a fact of running any hosted service. We don't browse user documents for product, marketing, or curiosity reasons, and we don't train models on them. If we ever need to access a specific document to debug a reported issue, we'll tell you.

**What we log.** We send structured operational logs, first-party product analytics, error diagnostics, and—only when enabled after privacy testing—sampled privacy-masked session replays to PostHog. We don't intentionally log document contents, keystrokes, comment text, transcript text, raw audio, signed URLs, provider raw JSON, OAuth refresh tokens, Slack bot tokens, hosted provider credentials, or push subscription keys. Error diagnostics can include stack traces, sanitized request paths, browser/runtime details, and error messages needed to investigate reliability or security issues. Replays mask all text and inputs and block collaborative content and private routes. PostHog data follows our configured retention periods.

**Deletion.** Archived documents are retained for up to 30 days so they can be restored. When an archived document is deleted forever, its private container, uploaded images, and access tokens are removed. Edge caches and operational logs may retain references for a short period before they roll over. We don't keep archived copies for analytics.

**Voice Notes beta retention.** Mobile recordings save locally first and are not uploaded to Comment.io in the current Android mobile path. When the on-device speech runtime and model pack are ready, transcription happens on the phone. If on-device transcription is not ready and no cloud provider is configured, transcription waits. When you configure or choose cloud transcription, the app sends audio directly to your selected Deepgram or AssemblyAI account using your API key, then uploads the raw transcript document to the Comment.io folder you selected. If you install the optional Transcript Cleanup Botlet, Comment.io posts a mention to that Botlet after upload; the Botlet can read and edit the saved raw transcript note and create a cleaned companion document in a sibling Clean folder. Transcript documents, cleaned companion documents, destination metadata, sync records, post-upload Botlet mention records, and encrypted provider-key settings when configured are retained until document/account deletion or a future granular mobile delete/export control removes them.

**Inactivity expiry.** Document access tokens auto-expire after 30 days of inactivity. A forgotten share link stops working on its own.

**Data export.** You can export any document as Markdown at any time. Leaving Comment.io is straightforward by design.

**If Comment.io shuts down.** If we ever wind the service down, we'll give at least 30 days' notice and provide a way to export your documents as Markdown before data is removed.

**OAuth provider compromise.** If your Google, Microsoft, or Apple account is taken over, anyone who can sign in as you can access your documents — Comment.io trusts the provider's answer. Use a strong password and two-factor authentication on the provider, and contact us if you suspect a takeover so we can revoke active sessions.

_Document requests are routed into a per-document execution and storage boundary._

```mermaid
flowchart LR
  B[Browser editor: REST + live sync]
  A[Agent or API client: REST API]
  W[Comment.io Worker]
  ACL[Token/session + role check]
  B --> W
  A --> W
  W --> ACL
  ACL --> D1[Document A container]
  ACL --> D2[Document B container]
  D1 --> S1[(Private storage for Document A)]
  D2 --> S2[(Private storage for Document B)]
  D1 -.-> B2[No access to Document B storage]
  D2 -.-> B1[No access to Document A storage]
  classDef blocked fill:#fff7ed,stroke:#ea580c,color:#7c2d12
  class B1,B2 blocked
```

## How document access works

Every document has a URL identifier, permissions, and access-token support. New normal documents start with General access set to anyone with the link at editor role; owners can switch a document to restricted access or change the link role at any time. For private or restricted documents, a person or agent needs a valid token, signed-in owner session, or explicit permission grant to read or modify content through the app, the live-collaboration connection, or the REST API. There is no listing or directory that exposes documents publicly — a document's existence does not make it discoverable.

Treat share links and API credentials like passwords. Anyone who receives a public document link can use the current General access role; anyone who receives a valid token can use the access that token grants until you rotate or revoke it from the document's Share menu. Public previews show only the title and timestamps — the actual text never appears in a preview.

Each document has a permissions list mapping people, browser visitors, and registered agents to one of four roles. Permissions and link settings are checked on our servers, not just in the browser — the UI can't be "inspected" to grant yourself extra access.

- **Owner.** Manage the document and its sharing settings, invite collaborators, change roles, use owner-only controls.

- **Editor.** Change document content and participate in collaboration.

- **Commenter.** Add comments and suggestions without broad document-management powers.

- **Viewer.** Read the document without changing it.

- **Agent access.** Registered agents are added to the permissions list by handle and receive only the role they were granted for that document.

Comments and suggestions carry author metadata. The server rejects unauthorized edits to a comment owned by someone else — your comments can't be silently rewritten by another person or agent.

## Encryption

### In transit

- Browser, live-collaboration, and REST API traffic is served over HTTPS. This encrypts data while it travels between your browser or API client and Comment.io's servers.

- Production session cookies are marked `Secure` and `HttpOnly`.

- State-changing browser requests carry a second hidden token to make sure they come from the real Comment.io app, not a hostile site.

### At rest

- All stored data — document text, comments, uploaded images, voice-note transcript documents, encrypted provider-key settings, and operational records — is encrypted at rest by Cloudflare. See [Cloudflare's encryption documentation](https://developers.cloudflare.com/r2/reference/data-security/) for the technical specifics.

- Registered agent secrets are stored as one-way hashes. We can't recover the original secret for you; if it is lost or exposed, generate a new one and the old one stops working.

_Encryption covers both the network path and the storage layer for document operations._

```mermaid
flowchart TD
  C[Client] -->|HTTPS/TLS| W[Comment.io Worker]
  W -->|authorized operation| D[Document container]
  D -->|persistent state| DS[(Encrypted storage)]
  W -->|uploaded images| R2[(Cloudflare R2, encrypted)]
  D -->|comments, history, sync| C
```

## AI agents and third-party access

Comment.io is designed so people can invite agents into documents. That doesn't mean every document is automatically sent to an AI provider.

- Comment.io doesn't send your document to an AI model by default.

- An agent can only read or write a document after it receives a valid document token or registered-agent authorization.

- If you paste a Comment.io token into another tool, install an agent, or configure a webhook, you're granting that external system the access represented by the token or integration.

- The hosted MCP connector uses OAuth 2.1 with PKCE. Access tokens are short-lived and audience-bound to the configured `/mcp` resource; refresh tokens rotate and detected reuse revokes the connection family.

- Connector tools reject credential-shaped arguments and token-bearing URLs. Browser links returned by the connector do not embed document access tokens.

- Revoking a connector grant immediately blocks future Comment.io access. Platform-agent and conversation-identity profile cleanup is best effort; retained profiles cannot use a revoked grant. Expired authorization codes and OAuth records are swept from connector storage.

- Hosted Botlets run server-side only when you enable or trigger that runtime. If you connect OpenAI/ChatGPT, the credential is envelope-encrypted at rest, decrypted only for authorized hosted runs, sent to the hosted runtime over an internal secret-gated request for that run, and never returned to the browser after connection.

- Hosted Botlet runtimes receive the decrypted provider credential/auth material, prompt, document context or excerpts/content you grant the bot, and return instructions needed to execute the run.

- Configured hosted experts receive scoped document tokens plus prompt, comment context, document excerpts/content, and return instructions needed to prepare or answer replies, including background prewarm when a welcome/example document is configured for it.

- Webhook URLs are checked so they can't be pointed at internal addresses or loopback. Notification payloads are scoped to the event being delivered.

Voice Notes beta is different because transcription is the feature: the Android app transcribes on-device when the speech pack is ready. When cloud transcription is configured or chosen, the app sends local audio directly to your selected Deepgram or AssemblyAI account using your API key, then uploads the raw transcript to the Comment.io folder you selected in Comment.io Settings > Automation. The optional Transcript Cleanup Botlet processes only saved transcript documents after you install it.

## Authentication and sessions

- **OAuth login.** Human accounts sign in through Google, Microsoft, or Apple OAuth. Comment.io receives only the identity information needed for login and display.

- **Browser sessions.** The session cookie is HttpOnly, secure in production, expires after 30 days, and can be renewed while active for up to 90 days.

- **Mobile sessions.** Comment Voice Notes uses short-lived access tokens and rotating refresh tokens. Refresh-token families can be revoked if a device or session is lost.

- **Cross-site request protection.** State-changing browser requests require a second token derived from your session, checked on the server before the request is accepted.

- **Agent credentials.** Registered agents use permanent `as_` secrets. We store hashes of these secrets and show the original value only when it's created.

- **Hosted provider credentials.** OpenAI/ChatGPT hosted-provider credentials are envelope-encrypted with a Worker-held key. Browser-facing responses show only a redacted connection view; internal runtime access is secret-gated and authorized before use, and authorized hosted runs receive the decrypted credential/auth material for that run.

- **Rate limits.** OAuth, handle registration, handle lookups, mobile voice-note mutations, and other sensitive endpoints are rate-limited per IP or account.

## How we run the service

We keep the moving parts small on purpose.

- **Vendors.** Cloudflare (Workers, private containers, R2, KV, CDN, DDoS protection, TLS); PostHog (product analytics and profile properties, operational logs, error reporting, source map processing, and sampled privacy-masked session replay diagnostics); Resend (email delivery, bounce, complaint, and unsubscribe handling); Google, Microsoft, and Apple for OAuth login when you choose that provider; Slack for slash commands and notification DMs when you install or connect Slack; browser/platform push services when you enable push; AssemblyAI and Deepgram for Voice Notes beta speech-to-text when you configure your own provider key; OpenAI/ChatGPT and hosted agent runtimes for hosted Botlets or hosted experts when you connect or use those features.

- **Logs.** Structured logs for status codes, request timings, and errors. We avoid intentionally writing tokens, passwords, OAuth refresh tokens, Slack bot tokens, hosted provider credentials, voice-note transcript text, raw audio URLs, signed audio URLs, and provider raw JSON to structured logs.

- **Input validation.** REST endpoints validate expected input shapes and reject unexpected fields that could confuse identity handling.

- **Code review.** Security-sensitive code paths — auth, token handling, document access, storage migrations, and comment authorship — are reviewed before deployment.

- **Environment separation.** Staging and production deployments are separate. Production deploys require explicit human approval through GitHub Actions.

- **No investors, no acquisition pipeline.** Comment.io is bootstrapped. We have no plans to sell user data to fund a pivot.

See the [Privacy Policy](/privacy) for the current data collection, retention, and vendor disclosure. If we add a new vendor that handles document data, we'll update this page and the privacy policy and date the change.

## Incident response

If we confirm a security incident that affects user documents or account data, we'll prioritize containment, revoke or rotate affected credentials where possible, preserve evidence, and notify affected users with what happened, what data was involved, and what action they should take.

## Responsible disclosure

Found a security bug? Email [max@comment.io](mailto:max@comment.io). We triage good-faith reports promptly. Please don't access, modify, or exfiltrate data that isn't yours — describe the issue and we'll reproduce it on a test document.

No service can promise that a breach is impossible. We've tried to describe honestly what we do to make one unlikely, and what we'd do if one happened. If you're storing regulated, legally privileged, or extremely sensitive material, evaluate whether these controls match your requirements. This page is a companion to the [Terms of Service](/terms), not a substitute for them.