--- title: "Security and data protection" description: "How EveryPage encrypts documents, why it stores no reader IP addresses, where data is processed, who the sub-processors are, and what it does not hold." canonical: "https://everypage.co/security" last-updated: "2026-09-17" --- # Security and data protection Trust and compliance # Security, stated plainly. What EveryPage does to protect your documents and your readers, what it deliberately does not collect, and the part most vendor pages skip: what it does not have. ## Documents are encrypted at rest Every document is encrypted with AES-256-GCM before it touches disk. Files uploaded to an account use that account’s own versioned key; anonymous uploads get a per-file key. Either way the key itself is wrapped with a master key and stored separately, so no plaintext key is ever at rest. Uploads are streamed and sealed in chunks rather than held whole in memory, with constructed nonces so a reordered or truncated stream fails authentication instead of decrypting as a shorter document. ## No reader IP address is stored When someone opens your document their address is run through a salted HMAC-SHA256 and only the hash is kept, as the key to a stable pseudonymous reader identity such as Reader #214. That gives you returning-reader detection and per-page timing with no address in the database to leak, produce or mishandle. Two things are true and worth knowing. The address is still processed in flight: rate limiting uses it, and a country lookup sends it to an external service before it is discarded, so it does leave the server for that one request. The resulting country is stored against the reader identity, because that is what the country breakdown in your reports is made of. ## Operated from the United Kingdom EveryPage is built and run in the UK, so processing sits under the UK GDPR. The EU has recognised that regime as adequate, which means personal data can flow from the EU without extra transfer safeguards. The service runs on a small stack of servers we administer directly, rather than a spread of managed cloud products each holding a copy of your data. ## Sub-processors The list is short by design. The authoritative version lives in the Privacy Policy; this is what it amounts to: - Stripe, for subscription billing. - Resend, for transactional email: verification, password resets, share and notification mail. - ip-api.com, for the in-transit country lookup. The address is used for that lookup and then discarded, never stored. - Cloudflare, for CDN and DNS in front of everypage.co. The site’s own visitor analytics are self-hosted and cookieless, so reading these pages does not ship your visit to an analytics company either. ## Reporting a vulnerability Email support@everypage.co. Machine-readable contact details are published at /.well-known/security.txt under RFC 9116. There is no bug-bounty programme; reports are read and answered by the person who maintains the code. ## What EveryPage does not have EveryPage is a small UK operation rather than an enterprise compliance programme, and it holds no SOC 2 or ISO 27001 certification. There is no standalone DPA to countersign today either; the processing commitments live in the terms and privacy policy. If your procurement needs one, get in touch and say so. Naming these gaps is more useful than implying they are covered. ## The detail, article by article The documentation covers each control in full, including how it behaves at the edges: - Security and access documentation - Encryption and privacy - Expiry and retention - Watermarking - Email gates and lead capture Read how secure sharing works in the product ## Questions procurement asks ### Are my documents encrypted? Yes, with AES-256-GCM at rest, using a per-account key that is itself wrapped with a master key. It is not end-to-end encryption: EveryPage holds the keys and can read your documents. That protects a stolen disk or backup, not the platform itself. ### Do you store my readers’ IP addresses? No. Each reader is identified by a salted one-way hash of their address, which yields a stable pseudonymous identity like Reader #214. The address is processed in flight for rate limiting and a country lookup, then discarded. The country is stored; the address is not. ### Where is our data processed? In the United Kingdom, under the UK GDPR. The EU recognises the UK as adequate, so personal data can flow from the EU without additional transfer safeguards. ### Do you hold SOC 2 or ISO 27001? No. EveryPage is a small UK operation and holds neither certification. What it can tell you precisely is what is stored, how it is protected, and what is not collected at all. For breach exposure that is the part that matters. ### Can we sign a DPA? The processing commitments are in the terms and privacy policy, and EveryPage does not currently publish a separate DPA to countersign. If your organisation needs one, get in touch. It is worth remembering what a DPA governs, which is the personal data a processor holds for you, and that no reader IP addresses are in that set. ### How do I report a security issue? Email support@everypage.co. Machine-readable contact details are at /.well-known/security.txt under RFC 9116. There is no bug-bounty programme.