Everything on this page is a control that exists in the product today. Where something does not exist, it is listed below under what we do not have, rather than left out.
Accounts
- Sign-in is Google or Microsoft OAuth. SlideWeave never asks for, receives or stores a password — there is no password to leak, reuse or reset.
- Sessions are short-lived tokens (24 hours by default) with separate refresh tokens. Expired refresh tokens are removed by a scheduled job, and signing keys can be rotated without invalidating anyone mid-session.
Access control
Organizations have four roles — owner, admin, editor and viewer. The role is checked on every organization endpoint on the server, not only reflected in what the interface shows you.
Audit trail
Presentation, version, organization and sign-in events are written to an append-only, hash-chained log: each entry hashes the entry before it, so altering or removing one breaks the chain from that point on. Tampering does not have to be prevented to be detected.
You can verify the chain and export the log yourself — they are ordinary endpoints, not a support request.
A scheduled job re-verifies the chain, and a second one re-hashes every published file against the checksum recorded when it was published. That is what catches a file altered directly in storage, outside the application.
Deletion and recovery
Deleting a presentation moves it to the trash, where it stays recoverable for 30 days. After that a scheduled job physically removes the files and the record — that job is the only code path in the product that erases anything permanently. Published versions are write-once: once published, that version’s content cannot be rewritten in place.
Deleting your account is one request, and it is not a support ticket either.
The service itself
- Served over HTTPS, with a locked-down content security policy.
- The API accepts browser requests only from our own front end.
- Rate limits on the API as a whole, and tighter ones on sign-in, token refresh and AI generation.
What we do not have
No two-factor authentication. No SAML single sign-on and no SCIM provisioning — signing in with a Google or Microsoft account is convenient, but it is not the same thing and we will not call it that. No IP allowlisting. No public API and no webhooks.
No security certifications, either: no SOC 2 report, no ISO 27001, and neither one in progress. We are not going to describe controls we have not built or an audit nobody has run. If your procurement process requires a certification, we are not the right fit yet — and we would rather you learn that on this page than three meetings in.
The guarantee we can actually make
Your presentations are ZiraDocs files and the compiler is Apache-2.0. The strongest commitment we can offer is not a promise about our systems; it is that you do not depend on them. You can take your files and keep building them without us — on any plan, on your own machine, with a compiler we do not control. Anyone can self-host it.
That is a smaller claim than a certificate and a firmer one than a promise, because you can verify it yourself in an afternoon instead of taking our word for it.
Reporting a vulnerability
If you believe you have found a security issue, email hola@slideweave.com. Please include enough detail to reproduce it. We will acknowledge your report and keep you updated while we work on a fix, and we will not pursue action against good-faith research.
Please do not disclose the issue publicly until we have had a reasonable opportunity to address it.