Security

An HTML presentation is a small program. This is how we make sure it can be shown safely, both for you and for your viewers.

Last updated October 17, 2026

Isolated execution

Presentations are never served from siktora.com. They run on a separate domain, in a sandbox with an opaque origin. This means a presentation's JavaScript cannot read Siktora's cookies, your sign-in, your viewer's sign-in or other presentations. The same isolation applies even if someone opens the presentation's address directly.

Short-lived, signed links

Once a viewer has met a link's requirements (password, email code or team sign-in), the browser receives a signed key that is valid for one version of one presentation for a few hours. Every request is checked against the link's status. When you turn off a link, delete the presentation or it expires, it stops working within seconds, even for someone who has it open.

Access control

• Passwords are stored as scrypt hashes with a unique salt, never in plain text.
• Email verification uses six-digit one-time codes valid for 10 minutes, with a limited number of attempts.
• Attempts to guess passwords and codes are rate limited per link and network.
• We never reveal which email addresses have access to a link.
• If you change the access rules, every viewer has to verify again.

Storage and infrastructure

• All data is stored encrypted in Azure, region Sweden Central, with zone-redundant storage.
• Services authenticate to storage and the key vault with managed identities. There are no stored storage keys.
• Uploads go straight to storage using write permissions that are valid for one file for 30 minutes.
• Zip files are checked for path traversal and unreasonable sizes before they are unpacked.

Abuse

Every presentation has a button to report content. Uploads are automatically checked for signs of phishing, such as password fields or forms that send data to other domains. We quickly take down content that breaks the terms.

Report a vulnerability

Found a security issue? Report it with the "Report content" button on any presentation and choose "Other", or contact us. We reply within two business days.