Trust and security
What happens to your deck.
You are about to hand us the document that describes your company, your numbers and your customers. This page is the specific answer to what happens to it: where it goes, how long it stays, and who else sees it.
Your files
Deletion here means deletion, and it happens after 30 days, or earlier, by your request.
We delete your presentation and every file we generate from it 30 days after your analysis finishes, or earlier by your request.
That covers the original file, the slide images, the scorecard, the analysis and the rebuilt deck. After it happens, buying the full package for that deck means uploading it again. The window is a setting rather than a law of nature, so if it ever changes, the date shown on your analysis changes with it. The Privacy Policy sets out the one exception. Analyses created before the current storage layout sit outside the automatic sweep until a migration lands; ask, and we delete those by hand.
We email you three days before that happens, so nothing disappears without notice.
One email, with the date, while there is still time to download.
You can delete your data yourself, at any time, from your account.
One analysis, or all of them. It happens immediately, it asks you to type a confirmation phrase first, and you get an email afterwards saying exactly what was removed and what was kept.
Deleted means the files are gone from our storage, not hidden.
The stored files, the working copy and the queue record all go. It is not a flag on a row that keeps the data around. Copies in backups are removed as those backups age out.
We keep your billing records, because they are financial records.
Invoices, payments and the log of staff actions on your account survive a deletion. We tell you that on the screen before you confirm, not afterwards. Deleting your data does not close your account; closing an account is something you ask us to do.
Who else sees it
The analysis is done by a large language model, so at some point a model reads your deck. The question worth asking is who keeps a copy afterwards. Here, the answer is nobody, and this section is why that sentence is allowed to stand. It also covers the one way a few words from your deck can leave our servers: when the full package checks a figure on a public website.
The model runs on AWS, called from our own AWS account, not on the model-maker's servers.
Your presentation is analysed by Claude models on AWS Bedrock. The request is made from our AWS account, and the model itself runs on AWS infrastructure that Amazon operates and bills us for. Your file goes from our storage to that service and nowhere else.
AWS does not store what we send the model, or what it sends back.
Bedrock keeps neither the input nor the output: nothing is written to durable storage, and no AWS operator can read either one. That is how the service works, as AWS publishes it, rather than something in our own code, so we check it against AWS's current terms whenever we revise ours.
Anthropic, the company that makes the models, never receives your deck.
This is the part most people assume is impossible. AWS deploys a copy of the model into an account the model's maker has no access to, which means Anthropic sees neither the prompts nor the results nor the logs. They are not a processor of your content, because nothing of yours reaches them.
Nothing you upload trains a model.
Not Anthropic's, not Amazon's, not anybody's. Inputs and outputs are not shared with model providers and are not used to improve the models. Your deck is analysed and then it is gone.
To check your figures, the full package reads public web pages.
When your deck states a market size or a competitor's claim, the rebuild may check it on a public website and show you the source. The model chooses which pages to read, and a page address can include words or figures from your deck. Our servers fetch the page, so the site sees our server's address and the page requested. The free scorecard does not use the web.
It is processed in the United States, and we will not dress that up as more than it is.
We use AWS's United States inference profile, so the request is handled in one of AWS's US regions rather than a single named one. Calling that data residency would be a stronger promise than the setup makes, so we do not make it.
Everyone else in the chain
AWS runs the models, the servers, the database and the file storage. Postmark sends our email. Paddle processes payments as our merchant of record. Google is used for staff sign-in only, never for yours. PostHog, on servers in the EU, counts visits to this website (the website, not the app) and, if you allow it, remembers your browser so we can see which pages led to a signup. Inside the EU and UK it asks first; the answer can be changed from the "Privacy choices" link in the footer. That is the whole list, and the privacy policy names them.
Each analysis is processed in its own working directory, and its files are removed when it finishes.
Your account, your content, your card
Account
- Passwords are hashed with argon2. We cannot read them.
- API keys are shown once and stored only as a hash.
- Links we email you are single-use and expire.
- Resetting your password signs out every other device.
- We rate-limit sign-in attempts.
- Staff access requires Google sign-in and is limited to named people.
Content
- You can only ever see your own analyses. The check is in the database query, not in the page.
- Nothing you have not paid for reaches your browser: the full package is only made after you buy it.
- Download links expire within minutes and are generated per request.
- Error messages never expose internal detail.
- We validate uploads before processing them.
- Staff actions on your account are logged.
Payment
- Card details go straight to Paddle and never touch our servers.
- Paddle is our authorised reseller and merchant of record: they take the payment, handle sales tax and issue the receipt.
- Payment events are signature-verified and replay-protected, so you cannot be charged twice for one package.
In transit and at rest
Encryption is not the interesting part of this page, but it is the part people ask about, so: it is on everywhere, and here is what that covers.
- Everything between you and us is encrypted in transit with TLS.
- Your files sit in a private bucket, encrypted at rest, that cannot be made public.
- The database and the cache are encrypted at rest as well.
- Neither has a public address. Only the application can open a connection to them.
- Backups are written to that same encrypted storage, on a schedule, and age out.
- Our secrets live in a managed secret store, not in a file on a server.
- The portal blocks inline scripts, so an injected script has nowhere to run.
The documents
The Terms of Service (2.0), the Privacy Policy (6.0) and the Refund Policy (3.0) are in force. They were written by reading the product's code rather than from a template, which is why they can tell you things a template cannot: which model reads your deck, what gets kept after you delete an account, and who decides a refund.
Security questions that this page does not answer go to support@pmoc.ai. If you are reporting a vulnerability, say so in the subject line and we will treat it as such.
The scientifically proven method to build a presentation your audience cannot resist.
Now that you know what happens to it.
Upload a deck and see what it scores. 5 scorecards free by default, and you can delete all of it in two clicks.