Security, in plain English.
Your raise, your investor list, your numbers — routing them through a new tool deserves a straight answer about how they’re protected. Here’s exactly what’s in place today, written to be accurate rather than just reassuring, and what’s still on our roadmap.
How your decks stay protected.
Who can open a gated link
A gated workspace asks every visitor for an email and a shared access password before any deck opens. You set it, and you can make decks public or private whenever you want.
- One gate per workspace; your admin dashboard sits behind a separate password.
- Team roles — owner, admin, editor — with team management limited to owners and admins.
- Sessions use signed, HttpOnly cookies; changing a password ends the existing ones.
- Gated decks and your dashboard are never indexed by search engines.
How passwords are handled
Passwords are hashed with scrypt — a deliberately slow, salted algorithm — and compared in constant time. We never store a password we can read.
- A random salt per password; we keep a one-way hash, never the password itself.
- Failed logins are rate-limited and delayed, with no hint about whether an account exists.
- MCP access tokens are shown once and stored only as a hash — we can revoke them, never recover them.
In transit & at rest
Every connection to Slideboard is encrypted with HTTPS/TLS. Your data lives on Supabase, which encrypts data at rest and requires TLS for its connections.
- HTTPS everywhere; session cookies are marked Secure in production.
- Published decks are delivered through short-lived signed links that expire after a few hours.
- Secrets live only in server environment variables — never in the codebase, never in the browser.
What we collect
Your account and decks, plus engagement data — including the email an investor enters at the gate and which slides they viewed — so your dashboard can show who’s reading.
- An investor’s identity on analytics comes only from a server-signed token — a browser can’t forge it.
- We never email your investors. Reminders go only to you, and email is optional.
- No third-party trackers — analytics are first-party, stored in our own database.
Stored in the EU, listed honestly.
Vercel
Hosting and compute — the application that serves your decks, dashboard and APIs.
Supabase
Database and file storage — your accounts, decks, analytics and the published deck files.
Resend
Transactional email — invitations and password resets only. Optional, and off until you configure it.
Your engagement data stays in your workspace. We don’t sell it, and there are no third-party analytics or ad trackers on your decks — only the sub-processors above.
Your data is yours.
Take it with you
Export any published deck to a pixel-perfect PDF that matches the live page, anytime from your dashboard. Your decks are never locked in. (PDF today; PowerPoint export isn’t built.)
Remove it on request
Today you can remove team members, revoke tokens and unpublish decks yourself. We keep workspace data — including investor view history — for as long as your workspace is active; to delete an entire workspace and its data, email security@slideboard.co and we’ll action it. Automated, self-serve deletion is on the roadmap below.
Found a security issue?
We’d rather hear it from you.
Report a vulnerability in good faith and we’ll acknowledge it and work with you on a fix. We won’t pursue researchers who follow responsible disclosure.
Machine-readable: /.well-known/security.txt
Not in place yet — but planned.
GDPR-aligned data handling
An automated system for data retention and deletion, including self-serve export and erasure of a workspace and its investor data.
Workspace-wide brute-force limits
A shared rate-limit store so login throttling applies across every server instance — on top of today’s per-attempt delay and deliberately slow password hashing.
Privacy Policy, Terms & DPA
Formal legal documents, prepared with counsel, that this page will link to once they’re published.
This page explains our practices in plain English. It isn’t legal advice and doesn’t replace a Privacy Policy, Terms of Service or Data Processing Agreement — those are in progress. A security or privacy question in the meantime? Email security@slideboard.co.