Security

Last updated 15 August 2026

Slidr holds documents people care about — board packs, financials, deals in progress. This page says what we actually do with them, including the things we have not built yet.

Where your data lives

  • Decks are JSON documents in a managed Postgres database, encrypted at rest by the provider.
  • Uploaded files (spreadsheets, PDFs, logos) go to S3-compatible object storage with versioning on, encrypted at rest.
  • Everything in transit is TLS. The app is served over HTTPS only.
  • Every table that holds your content carries a workspace column, and every read is filtered by the workspace of the session making it. A deck id from another workspace returns “not found” through every route — the API, the print view, and the export path — and that is covered by tests rather than by inspection.

What the AI sees

Less than you might assume, and that is a design decision rather than a privacy claim bolted on afterwards. When drafting a deck, the model is shown a sketch of each data block — its shape, its labels, and for documents a short text excerpt. It is not shown the values in your charts and tables. Deterministic code copies those in afterwards.

The practical effect: a 380 KB PDF reaches the model as a structural summary, not as its full contents. We use the Claude API, and your content is not used to train models. We do not sell it, and we do not share it with anyone other than the processors needed to run the service.

The one exception worth naming: pages in a scanned PDF that have no text layer are sent as images to be transcribed. That is the only path where a page of your document is transmitted verbatim, it runs only on scanned pages, and it is capped.

Access and authentication

  • Email and password, with address verification required before the first sign-in.
  • Passwords are stored hashed, never in plain text or recoverable form. Password reset is a single-use expiring link.
  • The forgot-password form reports the same result whether or not an account exists — otherwise it becomes a way for anyone to test which email addresses have accounts.
  • Sign-in and sign-up are rate limited, as are uploads, exports and every AI call.

Share links

A share link is a capability: whoever holds it can read that deck. The token is 128 bits of cryptographic randomness, there is one per deck, and revoking it kills access immediately rather than at the next sign-in. Shared decks are readable, never editable. If a deck is confidential, treat its link like the document itself.

Payments

A merchant of record processes payments and is the seller of record. Card details go to them and never reach our servers — we store only a customer reference and your plan status.

Infrastructure

The rendering service that produces PowerPoint and PDF files is private: it is not reachable from the internet and requires a shared secret on every route. The application is the only thing that talks to it, and it checks that you own a deck before rendering it. Backups run nightly with point-in-time recovery on the database and versioning on object storage.

What we haven’t done

Slidr is a young product and it is more useful to you if we say so:

  • No SOC 2 or ISO 27001. Neither is in progress. If your procurement requires one, we are not a fit yet.
  • No SSO or SAML, and no enforced two-factor authentication.
  • No roles yet. Everyone in a workspace has the same access. Per-member roles and invitations are the next thing being built, and until they ship a workspace is effectively single-user.
  • No customer-managed encryption keys and no data residency choice.
  • No penetration test by an external firm to date.

Reporting something

If you find a vulnerability, tell us before telling anyone else and we will work with you on it. We will not pursue anyone acting in good faith on their own account’s data. There is no paid bounty programme.

See also Privacy and Terms.