Security
- OAuth 2.1 with PKCE and Dynamic Client Registration; API keys and access tokens are hashed at rest (never stored in plaintext).
- Multi-tenant isolation enforced by database row-level security — every call is scoped to the signed-in account.
- All inputs are schema-validated server-side; Cloudflare Turnstile guards public form paths; HTTPS everywhere.
- Revoke a Claude connection under Account → Connected apps, or an API key under Account → API keys — instantly.
Report a security issue to contact@sitelas.com.
Data handling
The connector and editor only touch the signed-in account’s own data — sites and content, collection items, form submissions and contacts, and analytics. Data is stored in Sitelas’s managed database (Supabase) and private storage. Form submissions additionally leave that store in two ways you control: the notification email to the site owner (switchable per site), and a per-form webhook if you set one. Subscription payments are handled by Polar as Merchant of Record; Sitelas never stores your full card details. The full subprocessor list is in the Privacy Policy.
Frequently asked questions
›Do I need a Claude account to use Sitelas?
No. You can build, publish, and run a site entirely in your browser with the built-in editor and its own AI. The Claude connector is an optional second way in for people who live in Claude.
›Is my site really live, or just a preview?
Really live. Every site publishes to a real URL — a free yourname.sitelas.com subdomain, or your own custom domain with automatic SSL. Preview URLs are private until you publish.
›What does it cost?
Up to 3 subdomain sites at no cost, with the full editor and the connector — driving a site from your own agent is free on every tier. Every account also starts with $10 of in-editor AI credits, once, which never expire. Pro is $9/month per published site and adds a custom domain, full analytics, and higher limits.
›Can an agent run my sites without me?
Yes — generate an API key in Account → API keys and give it to your agent. It uses the same MCP tools with no interactive sign-in. Revoke it any time.
›What happens to my data if I delete my account?
Everything is permanently removed — all sites, pages, content, form submissions, contacts, AI credits, and connected domains — and any active subscription is cancelled. It cannot be undone.
›Does Sitelas handle payments for my site's customers?
No. Sitelas is website software. If your published site takes payments, that runs through your own provider (e.g. a Stripe payment link) into your own account — Sitelas is never in that flow.
Support
Questions, bugs, or feedback? Email contact@sitelas.com — we’re here to help you ship.
Keep reading
Start here
What Sitelas is, how to begin, and how a site gets from idea to live.
The editor
Change your site by hand: text, photos, theme, pages and posts, how each page shows up in Google, saving and publishing.
Your dashboard
Sites, form submissions, search & SEO, your business in Google, verifying your site with Google, custom domains, AI credits, plans and limits, your account and sign-in.
Agents & MCP
Connect Claude, what your agent can do, the tool reference, and API keys for headless access.