Security
Safe to share, by design
DeckLume treats prompts, links, documents, images and AI output as untrusted. Structure is kept separate from rendering so every deck is safe to host, share and archive.
Structure first, HTML second
Decks are stored as validated, structured data. The HTML you present is compiled from it, with content hashes and validation reports, and can be rebuilt the same way every time.
Sandboxed previews
Previews run in sandboxed frames under a strict content policy. The deck runtime is a small, reviewed script; no model-written code runs in your deck.
Your workspace is yours
Decks, brand kits, files, jobs, exports and share links belong to a person or workspace, and every read and write checks that ownership first.
Exports that stay offline
Portable exports refuse remote resources, strip location data from images and check for external scripts or network calls before you download them.
Sources are data, not instructions
Uploaded files and web pages are passed to the AI as untrusted reference material, and each step only has the tools it needs.
An audit trail
Sign-ins, billing, sharing, uploads, exports and revisions are recorded with sensitive values redacted, so admins can review what happened.
Found a vulnerability?
Please report it privately to security@decklume.app and give us a chance to fix it before sharing it publicly. Our privacy policy explains how we handle your data.