Decky AI security, data handling and GDPR
How Decky AI handles slide content: zero data retention, EU hosting, the full subprocessor list, what Enterprise changes, and what Decky AI does not currently certify.
Presentation decks are among the most sensitive documents in professional services: unannounced deals, unpublished results, client strategy. This page states plainly what happens to that content.
The short version
- Slide content goes to the language-model provider for inference only, and is not stored by Decky AI. Zero data retention by default.
- Slide content is never used to train models.
- Hosting, authentication and storage are on Microsoft Azure in the EU.
- The full subprocessor list is public and maintained live at decky-ai.com/subprocessors.
- Decky AI does not currently hold SOC 2 Type II or ISO 27001 certification.
What leaves the device
Only a small, well-defined set of information is sent off the user’s device — the deck as a whole is not uploaded to Decky AI’s backend:
| Data | Destination | Retention |
|---|---|---|
| Slide content and conversation, for inference | Language-model provider (Anthropic, or AWS Bedrock EU on Enterprise) | Not stored by Decky AI; zero data retention at the provider |
| Icon search queries | Decky AI backend → Azure OpenAI (embeddings) | Not retained as content |
| Image-generation prompts | Decky AI backend → Azure OpenAI | Not retained as content |
| Web search queries | Decky AI backend → Linkup (France, EU) | Not retained as content |
| Stock photo queries | Unsplash, Pixabay | Query only |
| Account and subscription data | Microsoft Entra External ID, Stripe | Retained for the life of the account |
| Slides explicitly saved to the Slide Library | Decky AI backend, EU-hosted | Until the user deletes them |
The deck itself is not uploaded to Decky AI’s backend. Only the specific tool inputs above are.
Model providers and retention
- Anthropic (United States) provides language-model inference on standard plans. Anthropic operates zero data retention for all Decky AI plans: inputs are technically cached for roughly five minutes to one hour to accelerate responses, then discarded, and are not used for training. Covered by a Data Processing Addendum and Standard Contractual Clauses.
- AWS Bedrock (EU) provides inference on the Enterprise plan, keeping model inference inside the EU. Covered by a DPA with EU data processing.
- Microsoft Azure OpenAI (EU) is used for embeddings that power icon search and for AI image generation. It is not used for chat or language-model inference on presentation content.
Hosting and infrastructure
- Microsoft Azure (EU) — application hosting, monitoring and logs, under a DPA with EU data processing.
- Business and Enterprise plans support regional processing with a choice of EU (Frankfurt) or US (Virginia) infrastructure, with no cross-region transfers.
- Microsoft Entra External ID (EU) — authentication. Processes email, profile and OpenID claims.
- Stripe (USA / EU-Ireland) — payment and subscription management. Receives a user ID and subscription information, not slide content. PCI-DSS certified, covered by SCCs.
Analytics and tracing — and how to switch them off
Two optional systems collect telemetry. Both are EU-hosted, both are opt-out for individuals, and both are technically disabled and unavailable for Enterprise customers:
- PostHog (EU) — pseudonymous usage and click events. It may include a prompt preview truncated to 200 characters. It contains no slide content.
- LangSmith (EU region) — truncated model-interaction data and user feedback, retained for 14 days, used for quality assurance.
Individual users toggle both off in the add-in settings.
The Slide Library
The Slide Library is the only feature that stores slide content, and only for slides a user deliberately saves. Saved slides are:
- EU-hosted
- Private to the user, or to the organisation for a shared library
- Deletable at any time by the user
- Never used to train AI models
If an organisation does not want slide content stored at all, the feature simply is not used.
GDPR position
- Operated by Maven Labs UG (haftungsbeschränkt), Munich, Germany — an EU controller and processor, directly subject to GDPR.
- Published subprocessor list, maintained as the authoritative live source rather than buried in a policy PDF: decky-ai.com/subprocessors.
- Data Processing Agreements with every subprocessor; Standard Contractual Clauses for the providers outside the EU (Anthropic, Stripe, Unsplash, Google Workspace).
- A separate Data Processing Agreement is available to Enterprise customers.
- Data-subject rights, legal bases and retention periods are set out in the Privacy Policy.
- The Standard/B2C plan is not authorised for special categories of personal data under Art. 9 GDPR; Enterprise customers may process them only with their own legal basis, under the separate DPA, and limited to what is necessary.
Access, identity and deployment
- Authentication through Microsoft Entra External ID.
- SSO and user provisioning on the Enterprise plan.
- Distribution through Microsoft AppSource (
WA200010199), so IT can review and deploy Decky AI centrally via the Microsoft 365 admin center like any other Office add-in — no unmanaged installs and no browser extension.
What Decky AI does not claim
- No SOC 2 Type II report.
- No ISO 27001 certification.
- No on-premise or fully self-hosted deployment.
- No customer-managed encryption keys.
If any of these are a hard requirement for a procurement process, contact
hello@decky-ai.com to discuss what is and is not possible today rather than assuming from this
page.
Frequently asked questions
Does Decky AI store my slides?
No. Slide content is sent to the language-model provider for inference and is not stored by Decky AI. The single exception is the Slide Library: slides a user explicitly chooses to save are stored EU-hosted, private to that user or organisation, deletable at any time, and never used to train AI models.
Does Decky AI train AI models on my presentations?
No. Slide content is never used to train models, by Decky AI or by its model providers. Anthropic operates zero data retention across all Decky AI plans, and Slide Library content is contractually excluded from training.
Where is Decky AI data processed?
Hosting, authentication, storage and analytics run on Microsoft Azure in the EU. Language-model inference runs through Anthropic (United States, under SCCs with zero data retention) on standard plans, and through AWS Bedrock in the EU region on the Enterprise plan. Business and Enterprise customers can choose EU or US regional processing.
Is Decky AI GDPR compliant?
Decky AI is operated by Maven Labs UG, a German company, and is built for GDPR from the ground up: EU hosting by default, a published subprocessor list, Data Processing Agreements with every provider, Standard Contractual Clauses for transfers outside the EU, and a Data Processing Agreement available to Enterprise customers.
Is Decky AI SOC 2 or ISO 27001 certified?
No. Decky AI does not currently hold or publish a SOC 2 Type II or ISO 27001 certification. Its security position rests on EU data residency, zero retention of slide content, and the contractual safeguards published on the subprocessor page.
Does Decky AI support SSO?
Yes, on the Enterprise plan, together with user provisioning. All plans authenticate through Microsoft Entra External ID.
Can we turn off analytics and tracing?
Yes. Product analytics (PostHog) and quality tracing (LangSmith) are on by default with an opt-out in the add-in settings for individual users. For Enterprise customers both are technically disabled and unavailable — not merely switched off.
Can IT deploy Decky AI centrally?
Yes. Decky AI is listed on Microsoft AppSource as offer WA200010199 and can be deployed centrally to users through the Microsoft 365 admin center, using the same review process as any other Office add-in.