Security, data and support
You are giving us reach into a live website. Here is exactly how far it goes.
Written for the person who will be blamed if it goes wrong — often an agency, sometimes the owner. If anything below is vague, ask us and we will make it specific.
What we can do on your site
A named list of operations, and nothing else
Replace a piece of text. Set a date. Upload an image. Add a section from a template. Each one is a defined operation with defined inputs — not a general instruction to a machine with a shell.
Only inside paths you allow
An allowlist of the content files and folders, and a deny list that cannot be overridden from inside a conversation: build config, dependencies, deploy settings, anything outside the site root.
With an identity scoped to that one site
A key or application password that exists for this workspace alone. It is not a shared account, and it is not your login.
Never raw database writes as a matter of course
Changes go through files and documented interfaces. Arbitrary SQL is not how this works.
And nothing of ours runs on your site
A section we keep updated is finished HTML in your own markup, sitting on your host and included by your page like any other part of it. No script tag, nothing fetched from us when a visitor arrives, so your pages are no slower and search engines see the text. If we went away tomorrow, every section would still be there.
What we will not do
- Publish anything without checking your public page afterwards
- Write anything risky before a copy has been taken
- Offer an undo we cannot actually perform on your connection
- Delete published material silently — removal is marked and reversible
- Train anything on your site's content or your conversations
- Ask for your Instagram, your bank, or a login you would hesitate over
Credentials
Encrypted at rest in a dedicated secret store, referenced by the system rather than held in the part of the product you look at. Never in a browser, never in a log, never in an email. You can rotate or revoke from your side at any moment and everything stops working immediately — which is the correct behaviour.
Separation
One workspace per site, isolated from every other. A person invited to one site cannot see another, and an agency with fourteen clients has fourteen separate workspaces rather than one drawer with everything in it. Studio material sits in private storage that is not under any public web root.
Record
Every change, who asked, what was written, what the public page said afterwards, and every restore. Readable by you, exportable, and not editable by us after the fact. If something goes wrong at eleven at night, that log is what you read first.
Your data
It is your site, and it stays your site.
The workspace belongs to the website, not to whoever pays for it this year. An agency can hand it over, a client can take it on, and neither of them loses the history in the process.
Hosted in the EU. Cancel and your site carries on exactly as it is — we simply stop having access. Ask for an export and you get your content, your records and your log in a form you can read without us.
| Where it lives | EU data centres. Your site's content never leaves the workspace it belongs to. |
|---|---|
| Language models | Used to draft and to read your site. Under agreements that forbid training on what passes through. Facts marked as facts are never rewritten by one. |
| Sub-processors | Listed by name, with what each one does. Ask and you get the list rather than a paragraph about industry standards. |
| Processing agreement | A GDPR data processing agreement is available and signed as a matter of course for agencies and organisations. |
| Deletion | Ask, and the workspace and its backups are removed within thirty days. Your website is untouched by that. |
| If we get something wrong | You hear it from us, with what happened and what we changed. We would rather tell you badly than late. |
Support
A small team, answering in writing, in our own names.
There is no phone line and no chat bubble that pretends to be a person. There is a documented product, an inbox we read, and the same people who wrote the software answering in it — one of whom can appear directly in your panel and sign the message.
| Something is broken on a live site | Failed publish, failed restore, lost access | Same day, including weekends |
|---|---|---|
| Studio and agency accounts | Anything else you write in about | Same day on weekdays |
| Everything else | Questions, requests, opinions | Within one working day |
| Setting up your first site | Connecting, bounds, the first real change | We will do it with you, free |
support@sitecharter.com · we publish current status and any incident at status.sitecharter.com
Still a question you would want answered before connecting a client?
WE ANSWER THESE OURSELVES