Open beta: decks from your AI. Start free →
Security & trust

Security, in plain English.

Your raise, your investor list, your numbers — routing them through a new tool deserves a straight answer about how they’re protected. Here’s exactly what’s in place today, written to be accurate rather than just reassuring, and what’s still on our roadmap.

Last reviewed · June 2026 Plain-English summary — not legal advice Decks & data stored in the EU
In place today

How your decks stay protected.

01 — ACCESS & SHARING

Who can open a gated link

A gated workspace asks every visitor for an email and a shared access password before any deck opens. You set it, and you can make decks public or private whenever you want.

  • One gate per workspace; your admin dashboard sits behind a separate password.
  • Team roles — owner, admin, editor — with team management limited to owners and admins.
  • Sessions use signed, HttpOnly cookies; changing a password ends the existing ones.
  • Gated decks and your dashboard are never indexed by search engines.
02 — AUTHENTICATION

How passwords are handled

Passwords are hashed with scrypt — a deliberately slow, salted algorithm — and compared in constant time. We never store a password we can read.

  • A random salt per password; we keep a one-way hash, never the password itself.
  • Failed logins are rate-limited and delayed, with no hint about whether an account exists.
  • MCP access tokens are shown once and stored only as a hash — we can revoke them, never recover them.
03 — ENCRYPTION

In transit & at rest

Every connection to Slideboard is encrypted with HTTPS/TLS. Your data lives on Supabase, which encrypts data at rest and requires TLS for its connections.

  • HTTPS everywhere; session cookies are marked Secure in production.
  • Published decks are delivered through short-lived signed links that expire after a few hours.
  • Secrets live only in server environment variables — never in the codebase, never in the browser.
04 — DATA & PRIVACY

What we collect

Your account and decks, plus engagement data — including the email an investor enters at the gate and which slides they viewed — so your dashboard can show who’s reading.

  • An investor’s identity on analytics comes only from a server-signed token — a browser can’t forge it.
  • We never email your investors. Reminders go only to you, and email is optional.
  • No third-party trackers — analytics are first-party, stored in our own database.
Where your data lives

Stored in the EU, listed honestly.

Vercel

Hosting and compute — the application that serves your decks, dashboard and APIs.

European regionsHTTPS / TLS

Supabase

Database and file storage — your accounts, decks, analytics and the published deck files.

EU · Ireland (eu-west-1)Encrypted at rest

Resend

Transactional email — invitations and password resets only. Optional, and off until you configure it.

Invites & resets onlyNever to investors

Your engagement data stays in your workspace. We don’t sell it, and there are no third-party analytics or ad trackers on your decks — only the sub-processors above.

Ownership

Your data is yours.

EXPORT

Take it with you

Export any published deck to a pixel-perfect PDF that matches the live page, anytime from your dashboard. Your decks are never locked in. (PDF today; PowerPoint export isn’t built.)

DELETE & RETENTION

Remove it on request

Today you can remove team members, revoke tokens and unpublish decks yourself. We keep workspace data — including investor view history — for as long as your workspace is active; to delete an entire workspace and its data, email security@slideboard.co and we’ll action it. Automated, self-serve deletion is on the roadmap below.

Responsible disclosure

Found a security issue?

We’d rather hear it from you.

Report a vulnerability in good faith and we’ll acknowledge it and work with you on a fix. We won’t pursue researchers who follow responsible disclosure.

Machine-readable: /.well-known/security.txt

On our roadmap

Not in place yet — but planned.

Planned

GDPR-aligned data handling

An automated system for data retention and deletion, including self-serve export and erasure of a workspace and its investor data.

Planned

Workspace-wide brute-force limits

A shared rate-limit store so login throttling applies across every server instance — on top of today’s per-attempt delay and deliberately slow password hashing.

Planned

Privacy Policy, Terms & DPA

Formal legal documents, prepared with counsel, that this page will link to once they’re published.