# Share an HTML Report Only With People at Your Company

Canonical: https://commareports.com/share-html-report-internally
Published: 2026-10-21

> Restrict an HTML report link to your company email domain: anyone signed in with a verified @yourcompany.com address can open it, everyone else gets nothing. No per-person invites, no shared password, checked server-side.

# Share an HTML report only with people at your company

You have an HTML report — a dashboard export, a test run, an incident
write-up, something an agent generated — and it should be readable by
everyone at work and nobody else.

The usual options are all slightly wrong:

- **A public link** works until someone pastes it in the wrong channel.
- **Inviting people one by one** doesn't scale past the first ten, and
  misses whoever joins next month.
- **A shared password** gets forwarded along with the link and can't be
  revoked for one person. (More on that in
  [password-protecting an HTML report](/password-protect-html-report).)
- **The company intranet / SharePoint** can't render the HTML — it
  downloads the file or strips the scripts. See
  [SharePoint and OneDrive HTML previews](/sharepoint-html-preview).

What you actually want is the Google Drive setting: _anyone at Acme with
the link_. Comma has it for HTML.

## How to set it up

1. **Publish the report.** Drag the `.html` file onto
   [commareports.com](https://commareports.com/), paste it, or have your
   agent call `create_report`.
2. **Open Share → General access** and pick **People with a company
   email**.
3. **Check the domain.** Your own work domain is filled in for you. Add
   more if the audience spans several (`acme.com`, `acme.io`).
4. **Pick what they can do:** view, comment, or edit.
5. **Copy the link** and post it wherever your team talks.

The share dialog then reads, for example: _Only signed-in users with an
email at @acme.com can comment._

## Who gets in

| Visitor                                          | Result                        |
| ------------------------------------------------ | ----------------------------- |
| Signed in, verified `@acme.com` email            | Opens the report              |
| Signed out, works at Acme                        | "Sign in to open" → report    |
| Signed in with `@gmail.com` or another company   | Not available                 |
| Anonymous visitor the link was forwarded to      | Not available                 |
| Signed up with `@acme.com` but never verified it | Not available                 |
| Someone you invited by name (e.g. a contractor)  | Opens, with their invite role |

Two details make this hold up:

- **It's verified email, not typed email.** The check uses the domain of
  the viewer's confirmed address. Creating an account as
  `someone@acme.com` without access to that inbox gets you nothing.
- **It's enforced in the database.** The report row is only returned to a
  viewer who passes the check, so there is no client-side gate to bypass
  and nothing in the page source of the "Not available" screen.

A blocked visitor sees exactly what they would see for a deleted report.
The link doesn't confirm that anything exists.

## Don't add a public email domain

The allowlist accepts any domain you type, including `gmail.com`. Adding
one means _anyone with a Gmail address_, which is close to public. Keep
the list to domains your organization controls.

## Domain vs. team vs. invite

Comma has three ways to say "my people". They combine — invites always
work on top of the general setting.

| Setting                         | Use it when                                                                                 |
| ------------------------------- | ------------------------------------------------------------------------------------------- |
| **People with a company email** | The audience is "everyone at the company", including people you don't know yet              |
| **Team**                        | A specific group (the data team, the client squad) should see it, regardless of their email |
| **Invite by email**             | A handful of named people, or someone outside the domain                                    |

The full model, with link permissions and roles, is in
[sharing & access control](/docs/sharing).

## Set it from a script or an agent

Reports created over the API start `private`. To open one to the company,
call the share endpoint with a token that has the `sharing` scope:

```bash
curl -fsS -X PUT "https://commareports.com/api/v1/reports/$REPORT_ID/share" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "visibility": "domain", "allowed_email_domains": ["acme.com"], "public_permission": "comment" }'
```

The list replaces whatever was there, so send the full set of domains
each time. Agents do the same with the MCP tool `set_report_sharing`,
which takes the same `visibility` and `allowed_email_domains` fields:

> Publish `coverage/index.html` to Comma and share it with everyone at
> acme.com as commenters.

That one line is a good CI habit: every nightly report lands behind the
company domain without anyone touching the share dialog. See
[publishing from CI](/docs/ci) and the [Comma MCP server](/mcp).

## Good fits

- **Weekly metrics and BI exports** that everyone should see but that
  shouldn't leave the company.
- **Test, coverage and security reports** from CI — readable by any
  engineer, not by the internet.
- **Incident write-ups and postmortems** with internal hostnames in them.
- **AI-generated research and analysis** shared in a company-wide channel.

## Try it

Domain-restricted sharing is on every plan, including Free, with unlimited
reports and commenters.

**[Publish a company-only report →](https://commareports.com/)**

### Related

- [Sharing & access control](/docs/sharing)
- [Password-protect an HTML report](/password-protect-html-report)
- [Share an HTML report in Microsoft Teams](/share-html-report-in-teams)
- [Share an HTML file with a client](/share-html-file-with-client)
- [Get sign-off on an HTML report](/approve-html-report)