Access-controlled. Content is AES-256 encrypted in the page and decrypted locally in your browser; the password is never transmitted or stored.