2026-09-25
Reading data from shared offices · safer page passwords
- Fixed: when several people at one company read their links from the same office network, reading time past about 600 beats an hour (roughly a committee of two reading for an hour) was silently dropped. Limits now apply per link and network, with a much higher ceiling per network that only stops floods. Comments work the same way.
- Page passwords are now stored salted and slow-hashed. Pages protected before today keep working with the same password; setting a password again upgrades it.
- Password guesses are capped at 10 per page per network per hour.
- Hosted pages now tell the browser they can't register tools with a visiting AI browser agent, or ask a reader for camera, microphone, location or payment access.
- Publishing now refuses pages shaped like credential phishing: password fields and redirects to another site. Forms that submit to another site are refused for accounts in their first 7 days and flagged after that. The error tells your AI what to change.
- Page history is capped: each page keeps its first version, its latest 20, and any version a reader commented on. Older in-between versions are removed nightly (the privacy notice says so). Each account can also publish up to 50MB of pages a day.
- Reported pages can now be taken down (reversibly) within minutes of a report, from a phone.
- New: page playbooks served by Dealpages itself, so every connected AI builds pages the same careful way: a deal room, a proposal and a mutual action plan to start. Each tells the AI what to pull from your call, what to ask, what never to invent (prices, dates, people, customer claims) and how the page should look. Three new tools: get_skill, get_house_style, set_house_style (17 tools now).
- New: house style. Your AI drafts your logo, colors, fonts, voice and approved proof points from your website, you approve them, and every page uses them. Pages only quote proof points from your house style. See it on your account page.
- New: update_section and add_section. Your AI can change one section (say, pricing) or add one (say, security) without resending the whole page; get_page can return a single section too. Same links, new version, comments re-anchored (19 tools now).
- Buyers' AI assistants can now read a page without a browser: every link has a text version (/text), the deal facts as data (/facts.json), and a way to ask the sender a question (/ask), which arrives as a comment labelled as sent by an AI assistant. The link is still the permission, and reads are recorded against it and shown to you honestly as an AI assistant's read.
- Reliability fixes from the review: faster lookups on the busiest paths; the nightly jobs run independently so one failure can't skip the rest; retrying a publish with the same key at the same moment can't make two pages; simultaneous updates can't collide; republishing counts toward the page limit; image uploads and test notifications are rate-limited; cookieless visitor hashes are deleted after a day, as the privacy notice says.
- More fixes from the review, on the buyer side: reading data and comments are checked for size and shape and only recorded for sections a page really has; a page that's offline takes no new reading data or comments; the text version and facts.json only ever show what the page itself shows; your Activity feed now credits a read to a person's link, not to the person; "opened for the first time" can't repeat; image copying and notification addresses get the same public-address checks. The privacy notice now also covers the owner cookie and what notification emails carry.
- Security fixes from a full review: the console and sign-in screens can no longer be embedded in another page; text in confirm dialogs can't run as script; sign-in can't be triggered from another site; and a page taken down after a report stays down until the operator restores it.
- Four more playbooks: post-call recap, champion kit, security and trust packet, and prospecting page. Your AI gets them automatically.
- Logo and image upload: from the Style page, or your AI uploads from a URL or the file (upload_image) and gets a permanent address to use in pages. PNG, JPEG, GIF, WebP or SVG, 1MB each (26 tools).
- New: notifications that wake your AI. Turn on email or give a web address (a scheduled AI task, an automation tool) and Dealpages sends one signed message when a stakeholder link is opened for the first time, someone new is likely reading, a comment or AI question arrives, a buyer's AI reads a page, or a page goes a week without readers. Off unless you turn it on; each event once; in Settings or via the notifications tool (25 tools).
- Read-only API keys (tick the box when creating one): a CRM sync or reporting agent can read pages, engagement and comments but can't publish or change anything. New tools check_page (every publish check, nothing stored) and mint_links (links for a whole committee at once); 24 tools.
- New tool what_changed: section-by-section changes between two versions of a page (22 tools).
- New: deal facts. Your AI stores a deal's shared numbers and dates once (set_facts) and pages show them with a small tag; change the price once and every page that shows it updates, with no republish. Two new tools, 21 in all.
- Your account has a new layout: Pages, Activity, Playbooks, Style, Connect and Settings in a sidebar. Activity is a plain feed of who opened what and how long they actually read, new-viewer signals and comments, in the same honest wording your AI gets. Still no charts.
- New examples, built by an AI with the playbooks: a deal room, a proposal and a mutual action plan for one fictional deal. They're on the homepage and the Playbooks page (formerly Templates). The older examples are retired.
- Publishing now warns while a page still has [[ placeholders ]] in it, so a half-finished page doesn't go out by accident.
- Getting started is three steps on the homepage: add the connector, sign in, paste a transcript. When an AI connects to an account with no pages yet, Dealpages now tells it how to offer a first page, and every connected AI gets the same short guide to the workflow and the honest-signal wording.
- The sign-in email's subject now reads "Sign in to Dealpages".