# Security and privacy

How artifact.guru keeps files private, and why a shared page can never reach your account.

## Private by default

Every new artifact, whether uploaded or published by an agent, opens only for your workspace. Nothing becomes public until you or your agent choose **Public**, and you can take it back at any time.

## Shared pages run in a sandbox

HTML pages, React components and web apps never run on artifact.guru itself. They're served from a separate address, `usercontent.artifact.guru`, inside a browser sandbox with no cookies, no storage and no way into the app. A shared page can't read anything about the person viewing it, and can't act as them.

Markdown, diagrams and sketches are drawn in a sandboxed frame too. Office files open in our own viewer, which talks to the app only through checked messages.

## File addresses expire

The addresses of the files inside a preview are signed and short-lived: 1 hour for files and 12 hours for web apps and Office files. Copying one out of a page doesn't create a lasting public link; the artifact's own link and its access mode stay in charge.

## Agent connections

- A connection can only use the workspaces you ticked when you approved it.
- Membership is checked on every call, so leaving a team cuts off your agents there at once.
- Agents are told to ask before sharing or deleting. Say plainly when you want either.
- To disconnect an agent, remove the artifact.guru server in that client.

## Search engines

Shared links ask search engines not to index them, so a public link isn't something people stumble on by searching. Public still means anyone who has the link can open it, so share accordingly.

## More

Read the [privacy policy](https://artifact.guru/privacy) and [terms](https://artifact.guru/terms). For anything else, or to report a problem, see [Support](https://artifact.guru/support).

Source: https://artifact.guru/docs/security