How do I share an HTML report only with people at my company?

Publish the report on Comma, open Share, and set General access to 'People with a company email'. Your own work domain is filled in automatically. Anyone who signs in with a verified email on that domain can open the link; anonymous visitors and people on other domains cannot, even if the link is forwarded to them.

Do I have to invite every coworker individually?

No. That is the point of domain sharing. The allowlist is a list of email domains, not people, so a new hire with an @yourcompany.com address can open the report the first time they sign in. Individual invites still work on top of it for contractors or clients outside the domain.

Is the domain check done in the browser?

No. It is enforced in the database: the report row is only returned to a signed-in user whose verified email domain is on the report's allowlist. Unverified and anonymous accounts never match. The same check applies to the share link, the REST API and the MCP server.

Can I allow more than one domain?

Yes, up to 50 per report, for example acme.com and acme.io, or your domain plus a partner's. Domains are lowercased and de-duplicated, and you can paste them as acme.com, @acme.com or a full URL.

What does someone outside the domain see?

A 'Not available' page with no content and no title, the same response as a private or deleted report, so the link leaks nothing about what is behind it. A signed-out coworker gets a 'Sign in to open' button that returns them to the report after sign-in.

Can coworkers comment, or only read?

Your choice. The domain setting decides who gets in; the link permission decides what they can do: view, comment or edit. Commenting is the common setting for internal reviews.

Is this a paid feature?

No. Domain-restricted sharing works on every plan, including Free.

Share an HTML report only with people at your company

You have an HTML report — a dashboard export, a test run, an incident write-up, something an agent generated — and it should be readable by everyone at work and nobody else.

The usual options are all slightly wrong:

A public link works until someone pastes it in the wrong channel.
Inviting people one by one doesn't scale past the first ten, and misses whoever joins next month.
A shared password gets forwarded along with the link and can't be revoked for one person. (More on that in password-protecting an HTML report.)
The company intranet / SharePoint can't render the HTML — it downloads the file or strips the scripts. See SharePoint and OneDrive HTML previews.

What you actually want is the Google Drive setting: anyone at Acme with the link. Comma has it for HTML.

How to set it up

Publish the report. Drag the .html file onto commareports.com, paste it, or have your agent call create_report.
Open Share → General access and pick People with a company email.
Check the domain. Your own work domain is filled in for you. Add more if the audience spans several (acme.com, acme.io).
Pick what they can do: view, comment, or edit.
Copy the link and post it wherever your team talks.

The share dialog then reads, for example: Only signed-in users with an email at @acme.com can comment.

Who gets in

Visitor	Result
Signed in, verified `@acme.com` email	Opens the report
Signed out, works at Acme	"Sign in to open" → report
Signed in with `@gmail.com` or another company	Not available
Anonymous visitor the link was forwarded to	Not available
Signed up with `@acme.com` but never verified it	Not available
Someone you invited by name (e.g. a contractor)	Opens, with their invite role

Two details make this hold up:

It's verified email, not typed email. The check uses the domain of the viewer's confirmed address. Creating an account as someone@acme.com without access to that inbox gets you nothing.
It's enforced in the database. The report row is only returned to a viewer who passes the check, so there is no client-side gate to bypass and nothing in the page source of the "Not available" screen.

A blocked visitor sees exactly what they would see for a deleted report. The link doesn't confirm that anything exists.

Don't add a public email domain

The allowlist accepts any domain you type, including gmail.com. Adding one means anyone with a Gmail address, which is close to public. Keep the list to domains your organization controls.

Domain vs. team vs. invite

Comma has three ways to say "my people". They combine — invites always work on top of the general setting.

Setting	Use it when
People with a company email	The audience is "everyone at the company", including people you don't know yet
Team	A specific group (the data team, the client squad) should see it, regardless of their email
Invite by email	A handful of named people, or someone outside the domain

The full model, with link permissions and roles, is in sharing & access control.

Set it from a script or an agent

Reports created over the API start private. To open one to the company, call the share endpoint with a token that has the sharing scope:

curl -fsS -X PUT "https://commareports.com/api/v1/reports/$REPORT_ID/share" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "visibility": "domain", "allowed_email_domains": ["acme.com"], "public_permission": "comment" }'

The list replaces whatever was there, so send the full set of domains each time. Agents do the same with the MCP tool set_report_sharing, which takes the same visibility and allowed_email_domains fields:

Publish coverage/index.html to Comma and share it with everyone at acme.com as commenters.

That one line is a good CI habit: every nightly report lands behind the company domain without anyone touching the share dialog. See publishing from CI and the Comma MCP server.

Good fits

Weekly metrics and BI exports that everyone should see but that shouldn't leave the company.
Test, coverage and security reports from CI — readable by any engineer, not by the internet.
Incident write-ups and postmortems with internal hostnames in them.
AI-generated research and analysis shared in a company-wide channel.

Try it

Domain-restricted sharing is on every plan, including Free, with unlimited reports and commenters.

Publish a company-only report →