Security

• In transit: everything is served over HTTPS, including liite.co, every liite.site subdomain and connected custom domains, for which we issue and renew certificates automatically.
• At rest: our database and file storage providers encrypt stored data by default. Secrets you give us that we must be able to use again, such as an agency's own AI key, are additionally encrypted with AES-256-GCM under a key held only on our servers, and are never sent back to a browser.

• Passwords are stored only as salted scrypt hashes. We can't read them and never email them.
• Sign-in attempts are rate-limited per account, and emailed links (verification, reset, sign-in by link) per account and per hashed IP address.
• The session cookie is HttpOnly and Secure, set on liite.co alone and never on liite.site or a connected domain, so code on someone's site can never see it.
• Password-reset, verification and sign-in links are single-use tokens that expire within an hour to a day. We store only a SHA-256 hash of the token, so a database leak gives no working links.
• You can also sign in with Google or GitHub, in which case no password is stored with us.

Liite hosts other people's HTML and JavaScript. We keep it apart from everything that holds your data:

• Pages at liite.co/you are compiled by us from blocks and contain no user-written scripts. Every compiled page is served with a Content Security Policy, X-Content-Type-Options: nosniff, a strict referrer policy and frame protection.
• Uploaded sites run only on liite.site and connected domains, never on liite.co, so the browser treats them as a different origin from the dashboard.
• Custom HTML and AI chat blocks inside a page run in a sandboxed iframe on embed.liite.site, cut off from the page around them.

• Web addresses in pages, uploads and short links are checked against Google Safe Browsing for phishing and malware.
• Uploaded HTML and scripts are scanned for password and payment fields and for brand impersonation, so a phishing kit can't hide behind a Liite address. Suspicious uploads are held for review.
• On paid plans, uploaded files are also checked against VirusTotal by fingerprint (SHA-256 hash); the files themselves aren't sent.
• Anyone can report a site. Reports are reviewed by a person and confirmed abuse is removed under the Acceptable Use Policy.

• Analytics are counted without cookies. Unique visitors are hashed with a secret that changes daily; the hash is deleted within 36 hours and can't be turned back into an IP address.
• Forms, sign-ups and reviews are rate-limited by a daily-salted hash of the sender's IP, which is all we keep for spam control.
• Password-protected pages allow ten wrong guesses per visitor every fifteen minutes; the unlock cookie is a signed token, not the password.
• Receipts, RSVPs and proposals are served as our own HTML with no scripts and are kept out of search engines.

Liite runs on established providers rather than our own servers: hosting and content delivery, a managed database and object storage, each with their own security programmes and certifications. The current list of providers and what each one receives is in the Privacy Policy.

• Production access is limited to the people who run Liite. [Confirm: two-factor authentication on every provider account]
• Secrets live in the hosting provider's encrypted environment configuration, never in source code.
• Every change goes through automated type checks, tests and build before it is deployed, and deployments can be rolled back in minutes.
• Backups are taken automatically by our database provider and expire within [backup retention period, e.g. 30 days].
• Admin actions on accounts and content are written to an audit log.

Polar is our merchant of record. Cards are entered on Polar's pages and never pass through Liite. We store only your plan and Polar's customer and subscription identifiers.

• Use a long, unique password, or sign in with Google or GitHub.
• Don't share secret edit links; anyone with the link can edit that item.
• If you add your own AI key in the editor, it stays in your browser. Remove it from a shared computer when you're done.
• Collect through forms only what you need, and tell visitors why; see the Data Processing Agreement.

If we learn of a breach that affects your data, we'll tell you without undue delay, and the relevant authority as the law requires, with what we know, what we've done and what you can do. Our commitments to customers as a processor are in the Data Processing Agreement.

If you think you've found a security problem in Liite, please email hi@liite.co with “Security” in the subject. Include what you found, how to reproduce it and, if you can, its impact. We read every report and will reply within three working days.

While researching, please don't access other people's data, change or delete anything that isn't yours, run denial-of-service tests or send spam. Use your own test accounts and stop as soon as you've shown the problem exists. We won't take legal action against research done in good faith within these lines. We don't run a paid bounty programme, but we'll credit you here if you'd like.