# Security

> Typeroll publishes static files with no database on the live site, keeps editing apart from publishing and gives people and AI agents only the access they need.

URL: https://typeroll.com/features/security/  
Updated: 2026-11-02

FEATURES · SECURITY

# Less to attack. Clear access.

Your live website is static files with no database behind it. Editing happens in Typeroll, apart from the site your visitors see, and every person and agent gets only the access they need.

[Start a 30-day trial](https://app.typeroll.com/login?mode=signup)

[Teams and roles](https://typeroll.com/docs/guides/teams-and-roles/)

![](https://typeroll.com/media/f0e489650aea3706-scenes-group-security-tight.webp)

STATIC BY DEFAULT

## Nothing to break into on the live site

Published sites are plain HTML, CSS and images on Cloudflare. Content stays in the CMS; the public site only gets the published files.

The CMS, Forms and Extensions run separately from the static website, and CMS updates never change a published site.

![](https://typeroll.com/media/52ceaa091200488c-detail-serif-cyan-magenta.webp)

## Access you control

### Roles

Owner, Admin and Editor. Editors change content but cannot publish, change settings, keys or domains, or export content.

### Shared sites

Give another company access to a single site only, as read, write or admin.

### API keys

Keys are created in the portal and shown once. The API and MCP never return them, and revoked keys stay listed.

### Owner review

Site owners approve changes from a private link, and every answer is kept in an audit record.

[Owner review](https://typeroll.com/features/owner-review/)

### Form submissions

Each submission is checked with a signed token, a honeypot, server-side validation and rate limiting.

### Uploads

SVG uploads are sanitized before they are stored or published.

![](https://typeroll.com/media/e038d44b883e91fd-halftones-eyes-cyan-symbol-magenta.webp)

AI AGENTS

## Agents get the access of their account

An agent connects with personal OAuth, a site API key or an organization API key, and its access is checked on every request. Signed in with OAuth, it can do exactly what that person can do.

Its edits land in drafts first, versions keep larger changes away from the live content, and people see every change in the same editor.

[Connect an AI agent](https://typeroll.com/docs/guides/ai-connections/)

## Related

- [Publishing](https://typeroll.com/features/publishing/)
- [A CMS for AI agents](https://typeroll.com/ai-agents/)
- [Open source](https://typeroll.com/open-source/)

START BUILDING

## Try Typeroll Cloud for 30 days.

Free during the beta. No payment card. After the beta, USD 39 per month, or USD 29 per month billed annually.

[Start a 30-day trial](https://app.typeroll.com/login?mode=signup)

[Read the docs](https://typeroll.com/docs/)