Security

PageTurner runs on Cloudflare. Files are stored in Cloudflare R2 and account data in a Cloudflare D1 database. Email is sent through Resend.

What protects your content

• Every publication, file, advert and statistic belongs to one customer organisation. Every request is checked against that organisation before anything is read or changed.
• Sign-in uses a one-time emailed link. Links expire after 15 minutes and can be used once. Session cookies are HttpOnly, Secure and SameSite=Lax.
• Sign-in requests are rate limited.
• Secret keys are stored as Cloudflare Worker secrets, never in the code.
• Pages send security headers including HSTS and no-sniff. Only your own embed addresses may frame a publication.
• Uploaded files are checked for type and size. Web addresses entered by customers must be https.
• Old reader statistics and expired sign-in links are deleted automatically every night.

Readers

Readers never sign in. Open publications can be read by anyone with the link. Password or lead-form protected publications ask before showing the pages.

Reporting a problem

Email jake@evolveadvice.co.uk with the details. We aim to reply within 2 working days.

Plain-English summary written for customers. It is practical information, not legal advice. Operated by Elfandor Ltd, jake@evolveadvice.co.uk.