Keeping your documents to the people you choose
Control who reads and edits your documents, and see how sign-in, sharing and your content are handled. Further down are the details a security review asks for.
What you control
- Who joins. Workspaces are invite-only: Owners and Admins send invitation links that work once, expire and can be tied to one email address.
- Who reads and who edits each folder and document. Can view and Can edit shares can end on a date you set. Viewers can't edit the text, but can comment and suggest changes by default.
- Which folders and documents stay with a few people, besides the workspace's Owners and people with Full access to a folder above. Before you restrict one, you see who will lose access.
- When someone leaves. Remove them and any document they have open turns read-only at once.
- What is public. A public link shares one document, and Stop ends it at once.
- Your writing. Download every document you have permission to export, or a whole workspace as a .zip of those documents, with drafts left out unless you include your own.
For security reviewers
How Colletta enforces access, signs people in and handles content today.
Access
The most each workspace role allows. On each folder and document, general access and sharing decide who gets that far, and each document's settings decide who may comment and suggest. Drafts are the exception: a draft is visible only to its author and the co-authors they invite, until it is published.
| Workspace role | Edit the text | Comment and suggest | Open a restricted item |
|---|---|---|---|
| Owner | Yes | Yes, by default | Yes, except other people's drafts |
| Admin | Where general access or a share lets them edit | Yes, by default | Only when listed on it, or with Full access to a folder above it |
| Member | Where general access or a share lets them edit | Yes, by default | Only when listed on it, or with Full access to a folder above it |
| Viewer | No, even on an item shared with Can edit | Yes, by default | Only when listed on it, or with Full access to a folder above it |
People with Full access to a document can limit commenting and suggesting to editors, or turn commenting off.
- Each folder and document can also be shared with people or teams as Full access, Can edit or Can view, which sets what they can do there.
- Access is checked on every request and on the live editing connection, so a change reaches documents people already have open.
- Search, backlinks, images and downloads include only documents the person can open.
- Related pages in search are found on our own servers, by a fixed open model we don't train. No document or search is sent to another service for it.
Sign-in and sessions
- Sign-in runs on a dedicated identity server that we operate ourselves, built on open-source software, with its own database.
- OpenID Connect with PKCE, state and nonce checks. Colletta accepts a sign-in only after verifying the identity server's signature on it.
- Passwords go only to the identity server, and Colletta never sees them. Accounts are matched by the identity server's account ID; Colletta also stores each person's name and email address.
- Actions that change access need two-factor sign-in (an authenticator app or a security key), whoever takes them: inviting, changing members, sharing, restricting, moving and deleting.
- Sessions are random 256-bit keys in an HttpOnly, HTTPS-only cookie. The database stores only a hash of each key, not the key itself.
- Sessions end after 8 hours of inactivity or 30 days at most. Signing out of either Colletta or the identity server ends both, and "Log out everywhere" ends every session. Deleting an account asks for a fresh sign-in.
Encryption in transit
All traffic uses HTTPS, including live editing (secure WebSockets). The software requires this in production: public addresses must use https and wss, session cookies are marked secure and sent only to Colletta, and the host must redirect plain HTTP to HTTPS and tell browsers to use HTTPS only.
Content handling
- Documents are plain markdown, and a .md download keeps that markdown.
- Uploaded images are served only to people who can open the document, with location and camera details removed on upload.
- HTML inside a document is never run. It shows as text, except collapsible sections, which Colletta draws itself.
- Deleted documents stay in the trash for 30 days, then are removed with their history, comments and images.
What we do with your data
Only what it takes to run Colletta for you. We never sell your data or show ads, and we never use the content of your documents for analytics or testing. We will never train AI on your documents, images or data.
The app sets two cookies, both for sign-in: one keeps you signed in, and a short-lived one is used while you sign in. The identity server sets its own cookies for the same purpose.
Two services help us run it. Sentry receives error reports, which leave out the content and titles of documents, names, email addresses and network addresses. Resend sends sign-in email, such as password reset links.
To ask what we keep about you, or to have it corrected or deleted, write to [email protected].
Reporting a security issue
Found a security issue? Email [email protected]. The same address is in our security.txt. Please test only against your own workspace.
Write the next document together.
Access is by invitation during the private beta. Join the waitlist for a place, and read the docs to see how Colletta works.