Security & Privacy
Honest about the data path.
The statements below reflect what the production system actually does — not a future promise. If something changes, this page changes too.
Production infrastructure
- Domain & edge: purposefuldeck.com via Cloudflare with Full (Strict) SSL/TLS
- Compute: AWS Amplify Hosting (Next.js App Router, server-rendered)
- Database: AWS DynamoDB, single-table, tenant-scoped keys
- File storage: AWS S3 private bucket, OAC enforced, public access blocked
- Authentication: AWS Cognito User Pool, email/password, invited users only
- AI generation: Amazon Bedrock (Claude 3.5 Haiku / Nova Micro) — inference only
- Cost guardrails: AWS Budgets alert at $5/month threshold
- Where are my files stored?
- Uploaded PDFs and generated exports are stored in a private AWS S3 bucket. The bucket blocks all public access. Files are accessed only through short-lived presigned URLs generated server-side. No file is ever served directly from a public URL.
- Who can access my projects?
- Projects are scoped to your account. Each project key in the database is prefixed with your tenant ID, so no query can return another user's data. Authentication is handled by AWS Cognito — email and password, with accounts created by invitation only.
- Is my confidential M&A data anonymized before it leaves my system?
- Yes. For due diligence and M&A decks, entity anonymization runs on your server before any content reaches the AI model. Target company names, email addresses, and domains are scrubbed. All financial figures — revenue, EBITDA, multiples — are preserved exactly. The AI model only ever sees anonymized content.
- Is the connection encrypted?
- Yes. Traffic flows through Cloudflare with Full (Strict) SSL/TLS before reaching AWS Amplify. Connections between Amplify and AWS backend services (DynamoDB, S3, Bedrock) travel over the AWS private network.
- Is my content used to train AI models?
- No. Your uploads, edits, and exported decks are never used as training data. This is a firm policy, not a configuration option. Amazon Bedrock, when enabled, is invoked under the same constraint — inference only, no training.
- What AI models does PurposefulDeck use?
- The default generator is deterministic — it runs without any external model call. When AI generation is enabled, PurposefulDeck uses Amazon Bedrock with Claude 3.5 Haiku or Nova Micro. All model calls are scoped to inference only. Per-project token and cost caps apply to every call.
- Does PurposefulDeck perform web research?
- No. The product works exclusively with sources you upload. It does not query the web, third-party databases, or any external data source on your behalf.
- What happens if I delete a project?
- Deletion removes the project record from the database and queues the associated S3 objects for removal. During the private beta, deletion is manual — contact us to delete a project and all associated uploads.
- Is there multi-user or team access?
- Not in this version. Accounts are single-user and tenant-isolated. Sharing and collaboration features are not yet available.
Questions or security inquiries
Email us directly at [email protected]. We respond within one business day.