Trust

The technical specifics behind our security page, for IT teams, developers and anyone doing due diligence. Every item here is in place today unless it says otherwise.

Last updated 12 October 2026

Hosting and data locations

• Servers: in London, UK. They run the API, the AI connector, the dashboard and the serving of published sites, and hold the account database.
• Site files: kept in durable object storage in the EU. That storage is the store of record; the London servers keep only a cache.
• Database backups: in the same EU storage, in a separate bucket with separate keys.
• Edge: a global network serves and caches public pages close to visitors.
• Outside the UK/EU: our sign-in, payment and email services process some data in the United States. The companies are named on our subprocessors page.

Network and transport

• Every hostname on pagelemon.com and pagelemon.dev is served through a global edge network that provides DDoS mitigation and TLS at the edge. Plain HTTP is redirected to HTTPS.
• Origin lock: our servers drop web requests that don’t come from the edge network’s published IP ranges, so the origin can’t be reached directly to bypass it.
• The hop from the edge network to our servers is also encrypted, with an origin certificate.
• HSTS (6 months, including subdomains) on pagelemon.com and the app, API and connector hosts. .dev is an HSTS-preloaded top-level domain, so browsers only ever reach user sites over HTTPS.

Site isolation and headers

• Separate registrable domains. User sites are served from *.pagelemon.dev; accounts, the dashboard and the API are on pagelemon.com. Cookies and storage of a user site can never reach the account session.
• Strict Content Security Policy on the marketing site (scripts only from our own origin, no framing), and X-Frame-Options: DENY on the dashboard.
• User sites are sent with X-Content-Type-Options: nosniff, a strict referrer policy and Cross-Origin-Opener-Policy: same-origin-allow-popups. We inject no scripts, trackers or cookies into them; the free-plan badge is plain HTML and CSS.
• Password-protected and members-only sites are never stored in shared caches (Cache-Control: private, no-store) and are never indexed.
• When a site is taken down for abuse, it is served with Clear-Site-Data, so a visitor’s browser drops its cache, storage and service workers.
• Site passwords are hashed with scrypt (random salt per site). The visitor’s unlock cookie is HMAC-signed, HttpOnly and Secure, and changing the password invalidates every old cookie. Failed unlock attempts are rate-limited.

Server hardening

• SSH by named personal keys only: password logins and root login are off. A host firewall allows only SSH and web traffic.
• Each service runs in its own container as a non-root user, with a read-only filesystem, all Linux capabilities dropped, privilege escalation blocked, and its own memory and process limits, so one fault can’t starve the rest.
• Secrets are split by service: the application can’t see the backup keys, and the backup job can’t see sign-in, payment or email keys.
• Storage keys are scoped to a single bucket and locked to our server’s IP address. Email keys can only send.
• Every release runs the automated test suite before it ships. Release images are built off the server and the previous one is kept for a one-command rollback.
• Staff actions in the admin tools are recorded in an audit log, and sensitive staff actions need a sign-in from the last 10 minutes.

Backups, versions and recovery

• Continuous database backup: changes are streamed to EU storage within seconds, with point-in-time restore.
• Tested restores: a restore drill rebuilds the database from the backup and runs an integrity check. Last run 12 October 2026: passed.
• Deletion lock: recent site files and database backups are under a bucket lock, so they can’t be deleted, even with our server’s own keys.
• Immutable versions: every publish is a new, unchangeable version; going live is a pointer swap, and rollback is one call. Every version is kept for 30 days, then the last one of each week, from 7 days (Free) up to 2 years (Company), per plan.
• No lost edits: each publish names the version it started from; if someone else published in between, it is refused with a clear conflict instead of overwriting their work.
• Serve-stale: public, published files can be served from the edge cache for up to 7 days if our origin is down or erroring. Private sites are never cached.
• Monitoring: an external check on a separate server tests the API, dashboard and connector every 5 minutes and emails an alert on failure. The application alerts on missing stored files.

Sign-in and account security

Account sign-in is handled by a specialist sign-in service. Today:

• Sign-in methods: one-time email code, Google, or password. Email addresses are verified with a code.
• Passwords: at least 15 characters, checked against known breached passwords at sign-up and again at sign-in.
• Account lockout after repeated failed attempts.
• We receive only a signed session token, verified on every request against our own domains. We never see or store account passwords.

Members-only sites sign visitors in with their email address on app.pagelemon.com, then hand the site a single-use code for its own cookie. No sign-in script runs on the site itself. Card payments are handled by our payment processor; card numbers never touch our servers.

AI connections and API tokens

• AI apps connect through OAuth with PKCE (S256) and resource indicators. Access tokens last 1 hour; refresh tokens rotate on use, connections end after 30 days unused, and reusing an old code or refresh token revokes the whole connection.
• API tokens and site tokens are stored only as SHA-256 hashes. Each token has scopes (deploy or deploy + manage), can be limited to one site, can expire, and can be revoked at any time.
• Human approval: inviting people, removing a site password, renaming and transferring a site return an approval link the account owner must open and confirm while signed in. A token alone can’t do them. Destructive actions are two-step.
• Every new token or AI connection shows as a notice in the account owner’s notifications in the app, and is usually emailed to them too.

Upload checks

• Leak guard: every text file is scanned for well-known kinds of secret keys and private keys. A match blocks the whole upload and reports the file and line.
• Version-control folders, environment files, dependency folders, source maps and key files are skipped and never served.
• Archives are unpacked with caps on size and file count while decompressing; links, devices, absolute paths and .. paths are rejected.
• Anonymous and Free sites accept web files only, checked by content: no programs, installers or scripts, and binary files must really be images, fonts, audio, video, PDF or WebAssembly.
• Uploads without an account are limited per network.

Phishing and abuse

• Chosen site names are refused if they are reserved, imitate high-risk brands (banks, payments, couriers, crypto, government, big tech) including lookalike spellings, or contain common phishing words. Custom domains imitating those brands are refused too.
• Unclaimed sites expire after 72 hours and can’t be password-protected, so they can’t be hidden from review. Unclaimed sites and sites under 7 days old send noindex.
• Anyone can report any site at pagelemon.com/report (every site also links there from /_pagelemon/report and its security.txt); reports go to staff, who can suspend a site immediately and ban accounts. Every staff action is audited.
• Site plugins warn and can be switched off if a page puts a password field next to them.

Email authentication

• *.pagelemon.dev: null MX, v=spf1 -all and DMARC p=reject, so no user-site address can receive mail or be used to spoof it.
• Mail sent on behalf of sites comes from pagelemon.dev, DKIM-signed, under strict DMARC (p=reject, strict alignment). Our own mail comes from pagelemon.com, DKIM-signed, with DMARC p=reject, so mail faking our addresses is refused.
• Site mail and our own mail use separate domains, so spam from a misused site can’t hurt delivery of sign-in and billing email.

Logs and data retention

• Access logs for the app, the API and published sites store truncated IP addresses and strip authorisation headers, cookies, query strings and secret link tokens. On our marketing site the log keeps only the ref, invite and utm_ parts of the query string, which tell us which link brought you. All logs roll over well within 30 days.
• Uploader IP addresses for sites published without an account are deleted after 30 days.
• Deleted sites’ files are removed after 7 days. You can download any site as a zip and delete your account yourself.

Certifications

Our hosting, edge network, sign-in, payment and email services are run by established providers that hold independent security certifications such as SOC 2 Type II and ISO/IEC 27001, and our payment processor is PCI DSS Level 1. These providers operate at far larger scale than Page Lemon, so capacity grows with us; our own plan for growing step by step is written down and triggered by measured load. Every company that handles your data for us is named on our subprocessors page.

Not done yet

We’d rather tell you than have you find out:

• Public Suffix List: pagelemon.dev is not yet on the Public Suffix List. Until it is, browsers treat sibling sites on pagelemon.dev as the same site for cookies. Our accounts are unaffected (they are on pagelemon.com); the submission is being prepared.
• Two-factor sign-in is not yet offered for Page Lemon accounts.
• Page Lemon has no SOC 2 or ISO 27001 certification of its own.

Report a vulnerability

Email support@pagelemon.com. Please don’t access other people’s data, disrupt the service, or publish details before we’ve fixed the issue. We won’t take legal action against good-faith research that follows these rules, and we’ll credit you if you’d like. Our contact details are also in security.txt.

To report a harmful site instead, use Report a site.