Documentation

NDA management

Each project starts with a default NDA template. Pro users can customize the NDA text. When you update the NDA, all existing reviewers must re-accept before regaining access.

• Every consent is recorded with timestamp, IP, user agent, and SHA-256 content hash
• Full version history is available on Pro plans
• Revoke access instantly, sessions are terminated immediately

Magic-link authentication

ProtoWall uses passwordless authentication. Reviewers receive a one-time login link via email that expires after 15 minutes. No passwords to manage, share, or leak.

Reviewer engagement analytics Pro

See exactly what each reviewer looked at. Per-reviewer view: top routes, time on page, daily timeline, first/last seen, and a session-by-session event log. Project-wide view on the Usage page.

• Sessions cluster on 30-minute idle gaps
• Per-session events CSV download
• Static assets and your own preview traffic are filtered out automatically
• Same data exposed via CLI and MCP server

Session stories Pro

One-paragraph narrated walkthroughs of what each reviewer did. Generated on demand, cached on the dashboard. Cap of 50 per month, shared across the dashboard, CLI, and MCP server.

Reviewer feedback widget Pro

Reviewers leave signed-identity comments from inside the prototype. Three modes per project: auto-inject (proxy adds the widget for you), manual (one <script> tag), or off. Comments are bound to invites — no anonymous feedback. Tagged by version automatically.

Project versions Pro

Promote a new prototype URL when you ship an updated version. Existing reviewers and invites stay on the same project; only the prototype URL changes. Engagement and feedback get bucketed per version using time windows — no version IDs to manage. Compare v1 vs v2 in the Versions card.

Project previews Pro

Run multiple parallel preview URLs under the same project — one per PR, branch, or experiment. Each lives at {project-slug}-{suffix}.proxy.protowall.app with its own prototype URL. Reviewers' invites are project-level so a single accepted invite covers every open preview. Engagement and feedback bucket per preview. Soft-close keeps history queryable.

Expiring access Pro

Set a TTL on each invite — 24h, 7d, 30d, or never — when sending it. A daily cron flips expired invites to revoked, kills active sessions, and writes an ACCESS_EXPIRED audit event distinct from manual revocation. TTL editable from the reviewer detail page or via API (expires_in / expires_at).

Access requests

People who land on a project URL they haven't been invited to can click Request access; you triage from a Pending requests card on the project page. Approving sends them the standard invite email. Declining is silent (no email back — no leak of project status). Available on every plan; Free's 5-invite cap surfaces an upgrade prompt at approval time if you hit it.