Security

Every person in a workspace has one of four roles:

• Owner: everything, including handing over ownership and deleting the workspace.
• Admin: workspace settings, members, invitations, and everything editors can do.
• Editor: create, edit, publish and share guides and collections. Can create access keys.
• Viewer: read guides and collections only.

showdo checks the role on the server for every change. A hidden button is never the only protection. A workspace owner or admin can also require blurring, switch typed-text capture off, limit invitations to certain email domains, and switch public links and link sharing off.

A new guide is visible to the workspace only. Someone with the right role can change that to "Anyone with the link" or "Public". Links to guides that are only for people with the link are not listed by search engines. Public guides can be. Owners and admins can switch either option off for the whole workspace, and a share link can be reset so the old one stops working.

Drafts are not shown to viewers or to visitors.

A company can show a guide inside its own web pages, for example a help site or an intranet. This works only for guides that are published and shared with "Anyone with the link" or "Public". Each workspace keeps a list of the websites that may show its guides. Only owners and admins can change the list, and until a website is on it, no other website can show a guide: the browser refuses.

Every other page of showdo refuses to be shown inside another website. A guide shown on another website sets no cookies, saves nothing on the visitor's device and loads no advertising, analytics or tools from other companies. A draft, a guide for the workspace only, or a guide in the trash shows only a plain "This guide isn't available" message.

• On your device first. showdo for Chrome, showdo for Mac and showdo for Android find personal details in a screenshot (such as emails, phone numbers, card numbers, ID and bank numbers, access keys, IP addresses and street addresses) and blur them before the picture is uploaded. The unblurred original never leaves your device.
• Passwords and card fields are never read. They are blurred even if auto-blur is off.
• Typed text is cleaned before upload, and cleaned again on the server when it arrives.
• A second check. After a guide is written, an AI check looks at the blurred screenshots and step text for details that were missed, and blurs or replaces them. You can undo it.
• Blur can be added later but never removed. Editors can add blur in the web editor.

This is strong but not perfect. Please look over a guide before you share it.

Pictures, videos and voiceovers are not served from open web addresses. showdo gives out a link that is signed and runs out, about an hour after it is made. A copied link stops working after that. Files are served with settings that stop a browser from running them as web pages.

When showdo is served over https, the sign-in cookie is marked secure, so browsers send it only over encrypted connections. It is also marked so that web pages cannot read it, and browsers do not send it with most requests started by other websites.

• Passwords are stored as a one-way scrambled value. showdo cannot read your password. Passwords must be at least 10 characters.
• Sign-in, sign-up, password reset and email-change requests are limited in how often they can be tried.
• Password reset links last 1 hour, and email check links last 24 hours. After a password reset, all other devices are signed out.
• Under Account you can see where you are signed in (browser, device and IP address) and sign out other devices.
• Changing your email, and deleting your account, need a confirmation sent to you. Deleting also needs your password if you have one.
• Sign-in requests are only accepted from showdo's own address.
• If you sign in with Google or GitHub, showdo uses them only to check who you are. The access codes they send back are thrown away and are not stored.
• Invitations last 7 days and can only be accepted by the person they were sent to.

When you connect showdo for Mac, showdo for Chrome, showdo for Android or another tool, showdo creates an access key for that device.

• The key is shown once. showdo stores only a one-way scrambled copy.
• A key can do only what its owner's role allows. A viewer's key cannot publish.
• A key stops working when it is turned off, or when the person leaves the workspace.
• Apps upload only to the showdo address they are signed in to. The Mac app keeps its key in the macOS Keychain. The Android app keeps its key in the app's private storage on the phone.
• showdo for Mac's local controls accept requests only from showdo's own pages, the Chrome extension and your own computer.

A key that is not used for 180 days stops working, and you sign in again to connect that device. Each time a key is used, the 180 days start again. You can also turn off any key you no longer use, in workspace settings.

showdo writes an entry whenever something important changes in a workspace: guides created, edited, published, shared, moved to the trash, restored or deleted, members and roles, invitations, workspace rules, access keys and the workspace itself. Each entry says who, what and when. Members can read the log on the Activity page. It does not include IP addresses.

When Ask showdo carries out a task in Chrome, it asks before it does anything that could be hard to undo, such as deleting, sending, paying or publishing. It never types into password, card or code fields, and it stops after 30 actions. Workspace admins can switch it off.

• We do not hold any security certificate or audit report, and this page does not suggest we do.
• We make no claim about how stored data is encrypted. That depends on the hosting companies on the sub-processors page.
• Two-step verification and single sign-on are not available yet.
• Content is not locked with a separate key for each customer, so people who run showdo's systems could technically reach it.
• We make no promise about how often showdo is available.

We would rather tell you what is missing than let you guess.

If you think you have found a weakness in showdo, please email [email protected]. Our contact details are also in a standard file at /.well-known/security.txt.

Please include:

• what you found and where,
• the steps to see it for yourself,
• anything you think it puts at risk.

Please:

• do not open, change or keep other people's information,
• do not slow the service down for others, and
• give us a reasonable time to fix the problem before you tell anyone else.

We will answer you and keep you posted. We welcome reports made in good faith.

If we learn of a personal data breach that affects you, we will tell you without undue delay, as the law requires. We report serious cyber security incidents to CERT-In (the Indian Computer Emergency Response Team) within 6 hours of noticing them.