Is Linkdeck secure?
Here is what protects a deck on Linkdeck, and what does not. Pages and deck files load over HTTPS. A deck password is stored only as a bcrypt hash, guessing is limited, and a protected deck's files sit in a secret folder whose address is handed out only after the right password. What no password can do is stop someone you let in from saving what their screen shows.
Who can open a deck
Anyone with the link, unless you add a password. Links are made from the deck's title, such as linkdeck.me/client-pitch, so they are easy to read and not secret: treat an unprotected link like a forwarded email. Anything confidential belongs behind a password, which you can set on a kept deck (€9 once) or on any deck with Pro (€12 a month).
The email gate is not protection. It asks for an email address before the deck opens, and anyone can type any address.
How passwords work
When you put a password on a deck:
- Linkdeck stores a bcrypt hash of the password, never the password itself.
- Each IP address gets ten tries per deck per minute. After that, tries are refused until the minute is up.
- The deck's files sit in a folder with a long random name that cannot be worked out from the link. Linkdeck tells a browser where that folder is only after the right password, and that pass lasts two hours.
- Setting or changing the password moves the files to a new random folder and deletes the old copies, so a file address someone saw earlier stops working. A new password also ends every pass given out for the old one.
- The preview image stays hidden: link previews in messages and social posts show no slide from a protected deck.
What we record about viewers
For the deck owner's analytics we record when the deck was opened, the kind of device (phone, tablet or desktop), the referring site, and time per slide. In the analytics database the viewer's IP address is kept only as a keyed hash, which lets us count unique viewers without storing the address. If you turn on the email gate, the address a viewer types is saved as a lead for that deck's owner. Our privacy policy has the details.
Deleting and expiry
A free deck lasts 3 days, or 24 hours if you upload without an account. Kept and Pro decks do not expire. When you delete a deck, or a free deck expires, its link stops working straight away. Once 12 hours have passed, the next cleanup run deletes the files from storage, along with the deck's view statistics and any emails it collected. Payments go through Stripe's checkout page; Linkdeck never sees card numbers.
What we do not claim
A password protects the link, not the pixels. Once a viewer is in, their browser loads the slides like any web page, and a determined viewer can screenshot or save them, or pass on the password. Changing the password keeps out anyone without the new one from then on, but it cannot take back what was already saved. Linkdeck has no single sign-on, no per-viewer permissions and no security certification such as SOC 2. If your process requires those, use a data room.
Questions
Can Linkdeck staff see my password?
No. Only a bcrypt hash of it is stored. If you forget it, set a new one in the deck settings.
What happens when I change the password?
The new password works at once and every pass from the old one ends. Linkdeck also moves the deck's files to a new random folder and deletes the old copies, so an old file address no longer opens it.
Will my deck show up in search results?
Every deck page tells search engines not to index it, and Linkdeck does not list decks in its sitemap or anywhere else on the site. A link travels as far as the people who have it share it. Add a password if that is not enough.
Can viewers download my .key file?
No. Linkdeck hosts the HTML export, not your Keynote file. Viewers get the playable deck in the browser, with no download button.
Send a deck behind a password
Upload your Keynote export, then keep it (€9 once) or go Pro to add a password, an email gate and per-slide analytics.
Free for 3 days. €9 once keeps one deck for good; €12 a month keeps every deck. See pricing