Security

Your presentations are stored locally, in your browser’s own storage — not on our servers. Our servers keep only account essentials (email, display name), billing records, and deck metadata such as title and slide count — never slide content, uploads, or files. Clearing your browser data deletes your decks permanently; we hold no copy to lose.

Generating a deck requires an AI model, so your prompt and draft content are processed in real time by our stateless edge service and the AI model API we configure. The processing is transient: no prompt or content logging, no storage, no model training — and your research results are cached in a store keyed to your account only, never shared between users. Payments are the same story: card details go directly to our payment provider’s checkout (a merchant of record — Paddle) and never touch our servers.

• Strict headers on every page: a per-request-nonce Content-Security-Policy, HSTS with preload, X-Frame-Options DENY, strict Referrer-Policy, and a minimal Permissions-Policy.
• Sanitised AI output: every AI-authored fragment is parsed and sanitised before it can render — enforced by guard tests in CI, not by convention.
• Verified webhooks: payment events are accepted only with valid signatures, and credit grants are idempotent.
• Parameterised data access: all database queries go through a typed ORM — no raw SQL, no string interpolation.
• Tight sessions: a single strictly necessary session cookie (SameSite=Lax, Secure in production — Lax so an emailed confirmation or reset link can complete its cross-site navigation) and least-privilege service keys between components.
• No third-party trackers: no analytics, advertising, or tracking scripts run on the site.

Found a vulnerability? Tell us at support@slideformat.com with enough detail to reproduce it. We will acknowledge your report, work on a fix, and credit you if you would like. Please use the service only in lawful security research and never access data that is not yours.

See the Privacy Policy for exactly what is stored where, and the Terms of Service for the governing terms.