# Decky AI security, data handling and GDPR

> How Decky AI handles slide content: zero data retention, EU hosting, the full subprocessor list, what Enterprise changes, and what Decky AI does not currently certify.

Last updated: 2026-07-27
Canonical URL: https://llms.decky-ai.com/decky-ai-security-data-handling-and-gdpr
Product site: https://decky-ai.com

---

Presentation decks are among the most sensitive documents in professional services: unannounced
deals, unpublished results, client strategy. This page states plainly what happens to that content.

## The short version

- Slide content goes to the **language-model provider for inference only**, and is **not stored** by
  Decky AI. Zero data retention by default.
- Slide content is **never used to train models**.
- Hosting, authentication and storage are on **Microsoft Azure in the EU**.
- The **full subprocessor list is public** and maintained live at
  [decky-ai.com/subprocessors](https://decky-ai.com/subprocessors).
- Decky AI **does not currently hold SOC 2 Type II or ISO 27001** certification.

## What leaves the device

Only a small, well-defined set of information is sent off the user's device — the deck as a whole is
not uploaded to Decky AI's backend:

| Data                                          | Destination                                                          | Retention                                                   |
| --------------------------------------------- | -------------------------------------------------------------------- | ----------------------------------------------------------- |
| Slide content and conversation, for inference | Language-model provider (Anthropic, or AWS Bedrock EU on Enterprise) | Not stored by Decky AI; zero data retention at the provider |
| Icon search queries                           | Decky AI backend → Azure OpenAI (embeddings)                         | Not retained as content                                     |
| Image-generation prompts                      | Decky AI backend → Azure OpenAI                                      | Not retained as content                                     |
| Web search queries                            | Decky AI backend → Linkup (France, EU)                               | Not retained as content                                     |
| Stock photo queries                           | Unsplash, Pixabay                                                    | Query only                                                  |
| Account and subscription data                 | Microsoft Entra External ID, Stripe                                  | Retained for the life of the account                        |
| Slides explicitly saved to the Slide Library  | Decky AI backend, EU-hosted                                          | Until the user deletes them                                 |

The deck itself is not uploaded to Decky AI's backend. Only the specific tool inputs above are.

## Model providers and retention

- **Anthropic** (United States) provides language-model inference on standard plans. Anthropic
  operates **zero data retention for all Decky AI plans**: inputs are technically cached for roughly
  five minutes to one hour to accelerate responses, then discarded, and are not used for training.
  Covered by a Data Processing Addendum and Standard Contractual Clauses.
- **AWS Bedrock** (EU) provides inference on the **Enterprise plan**, keeping model inference inside
  the EU. Covered by a DPA with EU data processing.
- **Microsoft Azure OpenAI** (EU) is used for embeddings that power icon search and for AI image
  generation. It is **not** used for chat or language-model inference on presentation content.

## Hosting and infrastructure

- **Microsoft Azure (EU)** — application hosting, monitoring and logs, under a DPA with EU data
  processing.
- Business and Enterprise plans support **regional processing** with a choice of EU (Frankfurt) or
  US (Virginia) infrastructure, with no cross-region transfers.
- **Microsoft Entra External ID (EU)** — authentication. Processes email, profile and OpenID claims.
- **Stripe** (USA / EU-Ireland) — payment and subscription management. Receives a user ID and
  subscription information, not slide content. PCI-DSS certified, covered by SCCs.

## Analytics and tracing — and how to switch them off

Two optional systems collect telemetry. Both are EU-hosted, both are opt-out for individuals, and
both are **technically disabled and unavailable for Enterprise customers**:

- **PostHog (EU)** — pseudonymous usage and click events. It may include a prompt preview truncated
  to 200 characters. It contains **no slide content**.
- **LangSmith (EU region)** — truncated model-interaction data and user feedback, retained for **14
  days**, used for quality assurance.

Individual users toggle both off in the add-in settings.

## The Slide Library

The Slide Library is the only feature that stores slide content, and only for slides a user
deliberately saves. Saved slides are:

- **EU-hosted**
- **Private** to the user, or to the organisation for a shared library
- **Deletable at any time** by the user
- **Never used to train AI models**

If an organisation does not want slide content stored at all, the feature simply is not used.

## GDPR position

- Operated by **Maven Labs UG (haftungsbeschränkt)**, Munich, Germany — an EU controller and
  processor, directly subject to GDPR.
- **Published subprocessor list**, maintained as the authoritative live source rather than buried in
  a policy PDF: [decky-ai.com/subprocessors](https://decky-ai.com/subprocessors).
- **Data Processing Agreements** with every subprocessor; **Standard Contractual Clauses** for the
  providers outside the EU (Anthropic, Stripe, Unsplash, Google Workspace).
- A separate **Data Processing Agreement** is available to Enterprise customers.
- Data-subject rights, legal bases and retention periods are set out in the
  [Privacy Policy](https://decky-ai.com/add-in-privacy-policy).
- The Standard/B2C plan is not authorised for special categories of personal data under Art. 9
  GDPR; Enterprise customers may process them only with their own legal basis, under the separate
  DPA, and limited to what is necessary.

## Access, identity and deployment

- Authentication through **Microsoft Entra External ID**.
- **SSO and user provisioning** on the Enterprise plan.
- Distribution through **Microsoft AppSource** (`WA200010199`), so IT can review and deploy Decky AI
  centrally via the Microsoft 365 admin center like any other Office add-in — no unmanaged installs
  and no browser extension.

## What Decky AI does not claim

- No SOC 2 Type II report.
- No ISO 27001 certification.
- No on-premise or fully self-hosted deployment.
- No customer-managed encryption keys.

If any of these are a hard requirement for a procurement process, contact
`hello@decky-ai.com` to discuss what is and is not possible today rather than assuming from this
page.

## Frequently asked questions

### Does Decky AI store my slides?

No. Slide content is sent to the language-model provider for inference and is not stored by Decky AI. The single exception is the Slide Library: slides a user explicitly chooses to save are stored EU-hosted, private to that user or organisation, deletable at any time, and never used to train AI models.

### Does Decky AI train AI models on my presentations?

No. Slide content is never used to train models, by Decky AI or by its model providers. Anthropic operates zero data retention across all Decky AI plans, and Slide Library content is contractually excluded from training.

### Where is Decky AI data processed?

Hosting, authentication, storage and analytics run on Microsoft Azure in the EU. Language-model inference runs through Anthropic (United States, under SCCs with zero data retention) on standard plans, and through AWS Bedrock in the EU region on the Enterprise plan. Business and Enterprise customers can choose EU or US regional processing.

### Is Decky AI GDPR compliant?

Decky AI is operated by Maven Labs UG, a German company, and is built for GDPR from the ground up: EU hosting by default, a published subprocessor list, Data Processing Agreements with every provider, Standard Contractual Clauses for transfers outside the EU, and a Data Processing Agreement available to Enterprise customers.

### Is Decky AI SOC 2 or ISO 27001 certified?

No. Decky AI does not currently hold or publish a SOC 2 Type II or ISO 27001 certification. Its security position rests on EU data residency, zero retention of slide content, and the contractual safeguards published on the subprocessor page.

### Does Decky AI support SSO?

Yes, on the Enterprise plan, together with user provisioning. All plans authenticate through Microsoft Entra External ID.

### Can we turn off analytics and tracing?

Yes. Product analytics (PostHog) and quality tracing (LangSmith) are on by default with an opt-out in the add-in settings for individual users. For Enterprise customers both are technically disabled and unavailable — not merely switched off.

### Can IT deploy Decky AI centrally?

Yes. Decky AI is listed on Microsoft AppSource as offer WA200010199 and can be deployed centrally to users through the Microsoft 365 admin center, using the same review process as any other Office add-in.