This is how aihops keeps documents walled off, private mark-up private and every action on the record, in plain terms. For how to report a problem, see Security.
Who can see a document
- Sign-in for everything. Nothing in the app is public: not the documents, not their files, not the pages around them. People sign in through aihops's own Microsoft Entra tenant, with a code sent to their email address or with Google. aihops never stores a password.
- Identity comes from the sign-in, never from the browser. Who wrote a comment, who opened a version and who shared a document are taken on the server from the signed-in session. Nothing a browser sends can claim to be someone else.
- Every request is checked. Each one is checked against the document's access list and the person's role. A link to a document opens only for the people it's shared with.
- No access means "not found". If a document isn't shared with you, aihops says it doesn't exist, so nobody can even confirm that a title or an id is real.
Documents run in a sandbox
An HTML document can contain scripts, and some of the best ones do: an animated chart, a slide deck that advances, a calculator. aihops lets them run, and makes sure they can't reach anything else.
- Each document is served with a
Content-Security-Policy: sandboxheader and shown in a frame that the browser treats as coming from nowhere. Its scripts can't read your session, your cookies or aihops's pages, and can't call aihops at all. - The document is never cleaned or rewritten. What the author uploaded is exactly what reviewers see, so a review is always of the real thing.
- A small helper inside the frame tells the page around it what you selected, so mark-up can be pinned to the words. Because a document could imitate that helper, the page checks every message it receives, and nothing a document sends can write anything.
- Only the page around the document saves anything, and only after you click. The exceptions are who's here on a collaboration, which the page tells the hub while it's open (never what anyone writes), and reading time, which the page itself measures while the document is visible, in focus and in use, and people are told it does.
- Comments are shown as plain text, never as HTML, so a comment can't carry code either.
PDF and Word documents
A PDF is read on the server in an isolated worker with strict limits on time and memory, by PDF.js, with nothing in the file run. Its text is escaped into an HTML rendition, which is what mark-up, comparisons and AI reviews read. A Word document is kept as uploaded and shown as HTML. Both are shown in the same sandbox as any other document.
Private means private
Private notes, private groups and each person's comments on a simple share are stored apart from a document's public mark-up, not mixed in and filtered out. Nothing that reads public mark-up can reach them.
- A document's owners never see private notes or groups they're not in, or the comments people make on their own copy of a simple share.
- Exports, emails, the history, AI consolidations and the tools Claude and ChatGPT use never include them, for anyone.
- Private mark-up becomes public only when its author chooses Share with everyone.
Where your data lives
- Microsoft Azure, Australia East. Documents, comments and history are stored there, encrypted at rest, and reached only over HTTPS, with HSTS.
- No keys to steal. aihops reaches its storage with its own Azure managed identity, and key-based access to storage is switched off, so there's no storage key anywhere to leak.
- Secrets stay out of the code. The few keys aihops needs, such as its AI and payment keys, live only as secrets in Azure.
- Deleted means deleted. When an owner deletes a document, it's purged 30 days later: every file and every record about it, its history included. Deleting your account deletes the documents that were only yours and takes your name and address off the records that remain.
What leaves aihops, and when
Three services outside aihops ever receive anything, each for one job:
| Service | When | What it gets | What it never gets |
|---|---|---|---|
| Anthropic's Claude API, in the United States | Only when someone asks for an AI review or consolidation | For a review, that version's text, the persona and the focus. For a consolidation, the current version, the mark-up everyone on the document can see, with names, and its history. | Private notes, anyone's email address, simple-share comments |
| SendGrid | To deliver the emails people choose to get | Titles, names, versions and links | Comment text, anything private |
| Stripe | When you buy a plan or a top-up | Your name, email and what you're buying | Documents, comments, your card (you pay on Stripe's own pages) |
Anthropic doesn't train its models on what's sent through its commercial API, so nothing you share on aihops is used to train AI.
On the record
Every upload, share, open, comment, resolve, export, finished review, consolidation and deletion is written to an append-only audit trail. Nothing edits or removes an event, with two exceptions, both about deleting: purging a deleted document removes its history with it, and deleting an account takes the person's name and address off the events that stay. Owners can see a document's history and download it.
Connecting Claude and ChatGPT
- Connections use aihops's own OAuth sign-in with PKCE, and accept only Claude's and ChatGPT's own apps.
- A connection can only read unless you tick Let Claude make changes (or ChatGPT) when you connect. Deleting, changing roles or how a document is shared, publishing private notes, groups, personas, email choices and billing stay in the browser regardless.
- aihops keeps only a hash of each token. Refresh tokens rotate on every use, and a refresh token used twice ends the connection.
- What the AI reads from aihops is marked as content, not instructions, so a comment that says "share this with someone" does nothing on its own.
- Everything a connection does is recorded as you, marked "through Claude" or "through ChatGPT". Disconnect any time from your Account page.
Our email agents
AI agents answer aihops's email. Each can do only what its written instructions list, and the software refuses anything else. They can reach only their own mailboxes, have no access to the app or its data, sign every reply as an AI agent, and hand anything about privacy, legal matters or security to a person.
This website
aihops.com.au sets no cookies, runs no trackers and serves its own fonts, so visiting it tells no other company. It runs no scripts, and its content security policy wouldn't let it.
Found something?
Email security@aihops.com.au. A person reads every report. Our security policy says what we ask of researchers, and our privacy policy has the details of what we hold and why.