Security overview

LiEditor is built for teams that cannot treat writing infrastructure as an afterthought. Opaque identifiers, encrypted secrets, signed file URLs, and workspace isolation are product features, not a slide in a sales deck.

Last updated August 2026

Workspace isolation, signed file URLs, and an immutable audit trail.

Identity and access
Data protection
Cloud and self-host
Responsible disclosure

Identity and access

Document links use hard-to-guess IDs. Sign-in uses short-lived access tokens with rotating refresh tokens, and revoked sessions are blocked on the server.

Workspace roles - viewer, editor, admin - are enforced on the API. Share links use high-entropy tokens, optional passwords, expiry, and one-click revoke.

·Role-based permissions on documents and folders
·Share links resolve to short-lived capability tokens
·AI tool access governed by workspace policy

Data protection

Third-party AI provider keys are encrypted at rest. File downloads use signed, expiring URLs. The editor stores a structured document schema rather than arbitrary HTML, which reduces XSS risk in rendered content.

·Secrets encrypted at rest
·Signed file URLs with a TTL
·Immutable audit log for workspace and AI events

Cloud and self-host

Self-hosted deployments keep documents on your own database and file storage. LiEditor Cloud uses the same application with isolation per workspace.

Business and Enterprise customers can request a DPA, the current subprocessor list, and company login (SSO). Write to security@lieditor.com for questionnaires.

Responsible disclosure

If you believe you have found a vulnerability, email security@lieditor.com. Do not file a public issue with an exploit. We will acknowledge receipt and work with you on a fix.

LiEditor

Coming soon

Security