Security

Version 1.3 · Effective: 02 November 2026

Version 1.3 revises and simplifies our security commitments and clarifies the use of automated tools for abuse prevention. Existing customers transition on the effective date above following 14 days' notice.

Displaydev OÜ operates display.dev. Our safeguards include encryption, access controls, security monitoring and incident response. No service can guarantee complete security.

Published content

HTML artifacts can contain scripts, embedded resources and links chosen by their publisher. These may send data to other services. Authentication controls who can view an artifact; it does not make its contents trustworthy or prevent a viewer from copying or sharing them. Publish sensitive material only with appropriate access restrictions and review content before interacting with it.

We may use automated tools and human review to investigate security threats and abuse. The scope and data handling are described in our Privacy Policy and Terms of Service. These checks do not guarantee that every threat will be detected.

Data handling

We use cloud providers for storage, hosting and delivery. Our Privacy Policy lists providers, data categories, processing locations and transfer safeguards. The Data Processing Agreement sets out our obligations when processing personal data on your behalf.

We encrypt data in transit using TLS 1.2 or higher and use encrypted cloud storage for customer content and application records.

Access controls

We authenticate users, enforce organization and artifact permissions, protect stored credentials, and restrict production access to authorized personnel. API keys have defined permissions and can be revoked. Publishers control the access settings for their artifacts.

Incident response

If we become aware of a security incident affecting Customer Content or personal data, we investigate, take steps to contain it, and notify affected customers without undue delay and within 72 hours where required by our DPA or applicable law. We provide information about the affected data, likely consequences and response measures as it becomes available.

We share a post-incident summary with affected customers after remediation. Report a suspected incident to privacy@display.dev.

Vulnerability reporting

Send reports to report@display.dev, including the affected service, steps to reproduce and potential impact. We review reports and prioritize remediation according to risk. We do not currently operate a paid bug bounty program.

Data use and assurance

We do not sell personal data or use Customer Content to train or fine-tune AI models. Provider processing and advertising disclosures are in our Privacy Policy and Cookie Policy.

We do not currently hold a SOC 2 report. Customers with security-review requirements can contact us for available documentation or a questionnaire response.

Contact

Displaydev OÜ

Ankru 8-23, Tallinn, 11713, Estonia