How we protect accounts, presentations, voice data, and generated media on SlideNarrator.
Overview
SlideNarrator is a SaaS product hosted on established cloud providers. We apply access controls, encryption in transit, workspace isolation, retention limits, and deletion tools so customers can manage their content. We do not currently hold a SOC 2 or ISO 27001 certification. Practices on this page describe what we do today.
Infrastructure
- Application hosting: Vercel (HTTPS by default)
- Database, auth, and some storage: Supabase (PostgreSQL with row-level security)
- Object storage and some TTS: Amazon Web Services (S3, Amazon Polly)
- Payments: Stripe (card data is handled by Stripe; we do not store full card numbers)
- Background jobs: Trigger.dev
- Caching / rate limiting: Upstash Redis
A full vendor list is published on our subprocessors page.
Authentication and access control
- User authentication via Supabase Auth (email/password and Google OAuth)
- Password requirements: minimum 8 characters with mixed case, number, and symbol
- Email verification for new accounts
- Protected application routes for dashboard, settings, and authenticated APIs
- Workspace membership with owner/member roles for shared team access
- Database row-level security (RLS) so users and workspace members only reach data they are authorized to access
- Rate limiting on selected high-cost processing and upload endpoints
Customer-facing multi-factor authentication (MFA) and enterprise SSO (SAML/OIDC) are not yet available. We plan to add them as enterprise demand requires.
Encryption
- In transit: TLS for the public website and APIs; HTTP Strict Transport Security (HSTS) enabled
- At rest: Customer data is stored with our cloud providers' standard encryption-at-rest controls (Supabase/Postgres and AWS S3)
Data handling and retention
- Unsaved / temporary processing files: deleted after about 7 days
- Saved project files: retained until you delete the project
- Generated audio for saved projects: retained about 30 days (regenerable)
- Generated videos for saved projects: retained about 15 days (regenerable)
- Custom voice samples and models: retained until you delete them or deactivate your account
We do not use your uploaded presentations or voice samples to train our own foundation models. Third-party AI providers process content only to deliver the features you request, subject to their terms and our agreements with them. Details are in the Privacy Policy.
Backups and recovery
Primary application data lives in managed cloud databases and object storage with provider-managed durability and backup capabilities. We rely on our providers' recovery features for infrastructure failure. Documented restore testing and customer-facing RPO/RTO commitments are available to enterprise prospects on request as we formalize operational runbooks.
Incident response
If we become aware of a security incident that affects customer personal data, we will:
- Contain and investigate the issue
- Assess impact and affected accounts or data
- Notify affected customers without undue delay, and within 72 hours where legally required (for example under GDPR)
- Remediate, document lessons learned, and prevent recurrence
Security reports: email info@slidenarrator.com with the subject line "Security incident".
Vulnerability disclosure
We welcome responsible disclosure of security vulnerabilities. Please email info@slidenarrator.com with enough detail to reproduce the issue. Do not access or modify other customers' data, and give us a reasonable window to investigate before public disclosure. We will acknowledge valid reports and keep you updated on remediation where appropriate.
Enterprise, DPA, and certifications
- Data Processing Agreement (DPA): Available for business customers on request at info@slidenarrator.com
- SOC 2 / ISO 27001: Not currently certified. We prioritize the operational controls on this page and will pursue formal audits when enterprise demand justifies the cost.
- HIPAA / BAA: SlideNarrator is not offered as a HIPAA-covered service and we do not sign BAAs at this time. Do not upload protected health information (PHI).