How it works
The whole thing, with nothing hidden.
Your agent is about to publish on your behalf. Before you trust it with that, here is exactly what happens to your work — step by step, and an honest account of what we can and can’t see.
Why this exists
Autonomous agents now produce real output all day — reports, dashboards, HTML pages, drafts. The hard part isn’t making it any more; it’s putting it somewhere safely.
Most people running an agent don’t want to think about web servers, hosting, or access control. So things go wrong: an HTML report with an API key baked in gets pushed to a public bucket; a draft meant for one person ends up readable by anyone with the link. The agent did its job; the publishing leaked.
freo is the safe place to put that output. Your agent publishes here instead of guessing at infrastructure — and you decide who gets to see each thing.
The flow, step by step
-
01
Sign in with your email
No passwords. We email you a magic link; clicking it drops you into your account. That’s the whole sign-up.
-
02
Get your personal @handle space
You land on your own corner of the web — a personal @handle that everything you publish lives under.
-
03
Connect your AI — two ways
Coding agent (Claude Code, Codex, Cursor, Windsurf…)? Paste one setup prompt from your dashboard — it installs the publishing skill. Chat assistant (Claude.ai, ChatGPT, Claude Desktop)? Add the MCP server as a connector and approve one consent screen — no token to paste. Either way, you do it once.
-
04
It claims a scoped key
Either way, access is scoped to your documents — your AI can publish and manage what you publish here, but can’t change your account settings, sign in as you, or touch anyone else’s space. A coding agent holds its own key; a chat app holds only the authorisation you approved. Revoke either instantly from your dashboard.
-
05
Just say “publish this for Angela”
No commands to memorise. You talk to your agent like a person; it figures out the file and the audience and calls freo.
-
06
We store it privately and gate it
Your document is stored privately — never in a public folder — and served only after the access check you chose passes.
-
07
You get a link — and see who reads it
freo hands back a shareable link, and Markdown opens as a polished page — contents, in-page search and highlighted code. Afterwards you can see who opened it and when, visible only to you.
What we can — and can’t — see
Straight talk, because it matters for trust. Standard documents are stored privately, but to render, scan, and gate them, our servers read them. They are not end-to-end encrypted. We will never tell you “we can’t see your files” for the standard tier, because it wouldn’t be true.
Standard documents
To render previews, scan for leaked keys, and run the access check you set, our servers read the file. Stored privately — but not end-to-end encrypted. We never train AI models on your private data, and we never sell your content.
Encrypted tier (optional, coming)
Content is encrypted in your agent before it reaches us; the key rides your share link and never touches our servers, so we genuinely can’t read it. The trade-off: no server-side previews, gating, or scanning.
How we keep it safe
Some of this is live today; some is on the way. We mark which is which — a roadmap item is not a promise that it’s already protecting you.
Private storage
Originals never sit in a public web root. Every read flows through an access check.
Sandboxed HTML
Published pages run in a locked-down, null-origin iframe — walled off from your account and ours.
Access controls
Public, unique link, email-protected, or a named allowlist. Remove someone and access is revoked instantly.
Never indexed
Served content carries noindex / no-referrer headers, so your work can’t leak into search or referrers.
Auto-retiring links
A share link nobody opens for about a month quietly goes private; set a hard expiry too. One click restores the exact sharing it had — you’re never locked out.
Secret scanning
Every publish is scanned for leaked API keys and credentials, and blocked before it goes live. New — in beta.
Content sanitising
Markdown is rendered, then run through an allowlist sanitiser that strips scripts, event handlers and dangerous links before the page ever reaches a viewer.
File-type enforcement
A file whose real bytes don’t match its extension — a script wearing a .png costume — is rejected on upload, closing the classic polyglot trick.
Malware scanning
Every upload is scanned by ClamAV before a viewer can open it. Anything that trips a detection is quarantined — held back from the public — while you keep full access to deal with it.
Metadata & location stripping
Uploaded images are re-encoded to drop EXIF and GPS data, so the camera model and the coordinates a photo was taken at don’t travel with your published files.
PDF normalising
Uploaded PDFs are rewritten through qpdf on ingest — decrypted and linearised — as defense-in-depth. Stripping every embedded action (JavaScript, auto-launch) is still in progress; until then, PDFs are served inside the same locked-down sandbox as every other page.
End-to-end encryption
A zero-knowledge tier where we never hold the key — content is scanned and encrypted on your device before it reaches us.
Complete deletion
When you delete a document or your account, it’s hard-deleted from our active database. We don't keep hidden copies.
Rate limiting & abuse prevention
Authentication routes and access gates are strictly rate-limited to prevent brute-force guessing attacks.
Ready to give your agent a safe place to publish?
Sign in with your email — no passwords — and you’ll have your space in seconds.