Plain answers to the questions agencies ask before they paste a staging URL into anything. Where we can be specific, we are.
A review is reached by its link. Links are 32 random characters, generated with a cryptographic random source, and are not guessable or listed anywhere. Anyone with the link can view and comment; that is what makes it work for clients with no account, and it is the same model Google Docs and Figma use for share links. Finishing a review locks its feedback. You can unshare a review at any time, which retires the old link and issues a new one if you want it. Archiving a review or moving it to the recycle bin takes its link offline immediately.
Your team signs in to create reviews, reply, resolve and approve. Clients never sign in.
When you add a password-protected staging site, HopBack stores the username and password in a table that no browser can read: database row security is on with no access policies, so the only way to it is our own server code, after checking you are a member of the workspace. The password is used once per page load, on the server, to fetch the site. Your client never sees it and cannot retrieve it.
Nothing is installed on the site and no script is injected into your client's pages. HopBack also strips third-party trackers (analytics, chat widgets, ad pixels) from the reviewed page, so opening a review does not fire your client's analytics.
Proxied page assets are cached briefly to keep reviews fast, keyed by the unguessable review token. Reviews are never indexed and never discoverable.
The database and file storage are encrypted at rest, and staging passwords are encrypted a second time by the app itself (AES-256-GCM) before they are stored.
Each image, PDF, video and comment attachment lives at an unguessable address that is shown only inside its review, and it is removed from storage when the review is permanently deleted, not left behind.
The database is backed up every day and each backup is kept for seven days. Those backups cover comments, rounds and approvals, not the files themselves; uploaded files are stored redundantly by the storage provider, and a permanently deleted file is gone for good.
Deleted reviews go to the recycle bin, where they can be restored for 30 days. After 30 days a daily job permanently deletes them, including their files. Archived reviews are kept and can be reopened at any time.
You can delete a workspace, or close your account, from Settings. Reviews, comments and files are removed after a 14-day grace period in case it was a mistake. During those days the workspace is read-only, and a banner lets you cancel the deletion.
Billing is handled by Stripe. HopBack never sees or stores your card number. Invoices are emailed and available in your billing settings.
On the Agency plan you can connect your own AI tools to your workspace through MCP. Access is by an API key you create in Settings. Keys are scoped to one workspace and are read-only: an AI tool can list reviews and read feedback, and cannot create, edit, resolve, approve or delete anything. We store only a hash of the key, never the key itself, and you can revoke a key at any time. Nothing leaves HopBack unless you connect a tool and ask it to read.
Email and password, a magic link, or Google and Microsoft sign-in. Password resets go through email. Sign-in attempts are rate-limited.
Email support@hopback.io. We read everything and reply to real reports.