A proposal built in HTML can be more useful than a PDF and more dangerous than an attachment. It can contain a live pricing table, a customer email address, a tracking pixel, an API token accidentally left in a code sample, and enough internal context to make Security ask several reasonable questions. Knowing how to share HTML securely means controlling the content, the audience, the lifetime of access, and the record of what happened after you sent it.
The usual shortcuts fail for different reasons. Public pastebins can be indexed or forwarded. Email attachments create copies you cannot revoke. A cloud drive link may provide access control but little visibility into whether a prospect read the proposal. Pasting AI-generated HTML into an unsanctioned tool creates an even less comfortable question: where did the source data go?
At Synergetics Worldwide, Inc., Chip Bellfort sends a proposal at 11:47 p.m. because the prospect is "absolutely still awake." Dwight Brenner, IT/Security Lead, notices the file includes a working test credential and next quarter's unannounced pricing. Chip files this under momentum. Dwight files it under the reason the publishing workflow needs guardrails before Chip gets momentum again.
Start with the content, not the link
Secure sharing begins before a URL exists. Treat the HTML and its source data as separate things that both need review. The page may be harmless while an embedded script sends visitor data to an unapproved service. Conversely, the markup may look ordinary while a comment, JSON payload, or sample configuration block contains a secret.
Before publishing, classify what is in the document. Customer names, email addresses, phone numbers, addresses, dates of birth, passport details, and Social Security numbers are personally identifiable information, or PII. API keys, bearer tokens, passwords, private URLs, and database connection strings are secrets. Pricing, pipeline data, and internal operating metrics may not fit either category, but they still deserve restricted access and a short retention period.
Automatic scanning is the practical first control. A secure sharing workflow should scan for common secret patterns before a link is created, then flag the finding for removal or replacement. PII detection should identify common sensitive fields and offer one-click redaction when the recipient does not need the underlying data. HTMLvault's scanner is regex-based across nine categories — SSNs, financial details, API keys, passports, person names, addresses, dates of birth, emails, and phone numbers — so it runs on every link for free and never sends content through a token-funded AI model.
You can also run the scan on its own, before anything is published. The scan_html tool is exposed over MCP and the REST API, so an AI assistant or an internal script can check a draft, return the findings, and let you fix them in the source document rather than in a live page.
Scanning reduces avoidable mistakes, but it is not a substitute for judgment. A scanner can find a token-shaped string. It cannot reliably decide whether a quarterly forecast is appropriate for a contractor to see. Establish an owner for the content and make the owner choose the intended audience.
Set access controls before you send
A secure link should have a defined access policy, not merely an obscure URL. Obscurity is convenient, but a forwarded link remains a forwarded link.
For material that should not travel beyond its intended recipient, use password protection and communicate the password separately. Set an expiry that matches the business purpose — HTMLvault supports anything from one hour to never on paid plans, while Free links expire after 30 days. A sales proposal may need access for two weeks; an internal incident report may need only a few days. For a document that must disappear after use, set an auto-delete retention window (Pro is configurable from auto-delete up to two years, versus a fixed 90-day retention on Free) rather than relying on someone to remember cleanup later.
Access settings are not one-way decisions. A link can be updated after it is sent: shorten the expiry, add a password, or delete the link outright with update_link, patch_link, or delete_link from the dashboard, the API, or an MCP client. If a proposal goes to the wrong distribution list, revoking access is a single call rather than a series of apologetic emails.
Also make sure published links are not indexed by search engines or AI crawlers. HTMLvault links are never indexed by default. This is a baseline safeguard, not an access policy: it helps prevent accidental discovery, but it does not prevent an authorized recipient from taking a screenshot or copying content elsewhere.
The rule is simple: choose controls based on the consequence of exposure. A public campaign landing page may only need a branded domain and analytics. A lead list or customer-specific proposal needs password protection, expiry, and limited retention. A report containing regulated or sensitive data may also require a documented approval path and tighter organization-wide rules.
Keep delivery clean and attributable
HTML is often shared because it is interactive. A recipient can use a pricing calculator, inspect a dashboard, or read a proposal on a phone without downloading a file. That advantage disappears when the delivery method causes email filters to become suspicious or encourages recipients to open an attachment from an unfamiliar sender.
A clean, branded link is usually the better distribution method. Serve it from a branded subdomain or a custom domain so the destination looks like your organization, not a generic file-hosting service. Pro includes one white-label domain, Teams includes one to three depending on the seat band, and Enterprise includes three. This matters to Marketing, which needs consistent campaign presentation, and to Sales, which needs the recipient to trust what they are opening.
Then make the engagement data useful. Track total views and unique visitors separately, because ten reloads from one evaluator are not ten buying-committee members. Review repeat visits, time on page, scroll depth, device, browser, geography, referrer, and server-side channel attribution in context. Per-recipient tracked URLs — generated in bulk with create_recipient_links — can show which contact opened the proposal without turning a shared group link into guesswork. Channels are unlimited on Pro and above; Free links do not carry per-channel attribution.
If your team already runs its own measurement stack, you can inject your own tracking code into the page alongside HTMLvault's native analytics. Keep that under the same review as any other third-party pixel.
Analytics has limits. A forwarded recipient may appear under the original recipient's tracked URL. Privacy policies, contractual obligations, and applicable laws may limit the tracking you should use. Use the minimum data needed for the commercial question at hand, and explain your practices where required.
Chip sees three proposal opens and starts drafting the victory note to Pennyman. Dwight points at the unique-visitor count: one person, one browser, three visits. The win was never the speech. It is the difference between one interested evaluator and three people quietly building a comparison spreadsheet.
Separate safe sharing from safe code
Access controls protect who can reach the page. They do not automatically make arbitrary HTML safe to render. If you accept HTML from users, contractors, or AI tools, establish a policy for scripts, embedded iframes, external assets, forms, and third-party pixels.
Do not assume an AI-generated page is free of risky code simply because it looks polished. Review unfamiliar JavaScript, avoid embedding secrets in client-side markup, and use approved analytics pixels only. If a page collects information through a form, make sure the receiving endpoint, data handling, and consent language have been reviewed separately.
This distinction matters during security review. Secret scanning answers, "Did we accidentally publish a credential?" Access settings answer, "Who can open this?" Code review answers, "What will this page do in the visitor's browser?" Each control covers a different failure mode.
Make governance easy enough to use
Security policies fail when the approved workflow is slower than emailing a file. Give practitioners a direct publishing path while giving IT the controls needed to approve it. On Teams, that means flat seat bands, custom roles and permissions, and audit logs covering who published what and when. SSO/SAML is available as a paid add-on on Teams and is included with Enterprise.
Account access itself is passwordless by design: sign-in uses magic links and passkeys, so there is no reusable account password to phish or rotate. Link passwords are a separate control — they gate a specific document, not an account.
For Teams and Enterprise organizations, BYOK AI scanning can use the company's own Anthropic, OpenAI, or Google key when AI-based analysis is appropriate. The customer controls the model relationship and token spend; HTMLvault never funds tokens. It is a useful additional review layer, but it should complement the deterministic regex secret and PII checks, not replace them.
Automation should follow the same rules as manual publishing. When an internal tool, CRM workflow, or AI assistant creates a link through the REST API or MCP tools such as create_link, create_links, scan_html, or create_recipient_links, assign a purpose, retention period, and access settings in the workflow itself. Claude, ChatGPT, Gemini, Zapier, Clay, and anything else that can call a REST API can all mint links this way, which means the policy has to live in the workflow rather than in a person's memory. Use webhooks — up to five on Pro — to notify downstream systems when a link is created or viewed. Do not give an automation a broad publishing credential and hope every generated page is suitable for every audience.
Use a repeatable publishing checklist
A practical workflow has four decisions: remove or redact unnecessary sensitive data; scan for secrets and PII; set password protection, expiry, and retention based on the audience; then send a branded, trackable link through an approved channel. Record who published it and retain the audit trail for as long as your policy requires.
That sequence is deliberately ordinary. The goal is not to make every proposal feel like a classified briefing. The goal is to make the secure route the fastest route, whether a RevOps analyst is sharing a lead list, a marketer is publishing a campaign page, or a sales team is sending a high-value proposal.
The person who benefits most is the practitioner under a deadline. They get to share useful HTML without creating a mystery for IT, a permanent copy in someone's inbox, or another cautionary story that gets told in a security meeting.