FEATURES · SECURITY
Less to attack. Clear access.
Your live website is static files with no database behind it. Editing happens in Typeroll, apart from the site your visitors see, and every person and agent gets only the access they need.
STATIC BY DEFAULT
Nothing to break into on the live site
Published sites are plain HTML, CSS and images on Cloudflare. Content stays in the CMS; the public site only gets the published files.
The CMS, Forms and Extensions run separately from the static website, and CMS updates never change a published site.
Access you control
Roles
Owner, Admin and Editor. Editors change content but cannot publish, change settings, keys or domains, or export content.
Shared sites
Give another company access to a single site only, as read, write or admin.
API keys
Keys are created in the portal and shown once. The API and MCP never return them, and revoked keys stay listed.
Owner review
Site owners approve changes from a private link, and every answer is kept in an audit record.
Form submissions
Each submission is checked with a signed token, a honeypot, server-side validation and rate limiting.
Uploads
SVG uploads are sanitized before they are stored or published.
AI AGENTS
Agents get the access of their account
An agent connects with personal OAuth, a site API key or an organization API key, and its access is checked on every request. Signed in with OAuth, it can do exactly what that person can do.
Its edits land in drafts first, versions keep larger changes away from the live content, and people see every change in the same editor.
START BUILDING
Try Typeroll Cloud for 30 days.
Free during the beta. No payment card. After the beta, USD 39 per month, or USD 29 per month billed annually.