Security and privacy
Your files stay in the EU.
Phase stores your files and visit data in the EU. On the Team plan, you store the files of a secure folder on your own server. Each reader accepts a tracking notice before the first slide.
Hosting in the EU
- Phase stores files, the database and visit data on servers in the EU.
- Phase sends sign-in and alert emails from the EU.
- You store the files of a secure folder on your own server.
- TLS encrypts the traffic between the browser and Phase.
Privacy of the reader
- The reader accepts a tracking notice before the first slide.
- The viewer sets no cookies. For a link, it stores nothing in the browser of the reader.
- A pack page stores one sign-in token in the browser after the reader signs in.
- Phase computes no fingerprint of a reader and sends no tracking pixels in emails.
- You can share any link with tracking off.
Access to your workspace
- You sign in with a link sent to your email. The link works once and for 15 minutes.
- Each workspace has owners, admins and members.
- A private file is visible to its owner and to the members the owner names.
- Phase records every change to a file in a history that nobody can edit.
Uploaded files
- Phase converts files on its own servers and sends them to no outside converter.
- The converter has no route to the public internet. It connects only to the other parts of Phase, the database and the file storage, inside our hosting platform.
- Each conversion starts with a clean profile and with macros off.
Secure folders
- On the Team plan, you store the files of a secure folder on a server that you own.
- The storage of Phase holds no copy of these files, their slide images or their thumbnails.
- Phase stores no text and no titles of these slides in its database.
- Phase stores the name, the size, the owner, the versions, the history and the analytics of each file.
- The Phase agent on your server sends outbound HTTPS requests only. You open no inbound port and you need no VPN.
- An upload, a download and a conversion pass through Phase. The browser and your server each connect over HTTPS. Inside our hosting platform the bytes travel on a private network. Phase stores none of them.
- Secure folders are not end-to-end encrypted.
- When your server is offline, the files stay on it. The library and the link of the reader show a notice. Both work again when the server returns.
- Phase has no copy of these files. You make the backups of that server.
Retention and deletion
- You set the retention period of visit data. The default is 24 months.
- You can delete the data of one reader on request.
- Deleted files stay in the trash for 30 days.
- When you close a workspace, its links stop at once. Phase deletes its data 30 days later.
Roles under the GDPR
- You are the controller of the data of your readers. Phase is your processor.
- Write to hello@pfase.com for the data processing agreement and the list of sub-processors.
Security questions answered
Does Phase have a SOC 2 or ISO 27001 certificate?
No. Phase holds neither certificate today. We answer security questionnaires by email.
Can I keep files on my own server?
Yes, on the Team plan. You store the files of a secure folder on a server that you own. The Phase agent runs on that server. Phase stores the name and the analytics of each file, and none of its content.
Does Phase support SAML sign-in?
Yes, on the Team plan. Your members sign in through your identity provider. The audit log shows each sign-in and each change to a setting.
Can Phase add a watermark or an NDA step?
No. Phase has neither today. Email verification, reader limits and expiry dates are available on the Pro plan.
Is the tracking notice legal advice?
No. We wrote the tracking notice from our reading of the EDPB guidelines on tracking. Ask your own counsel about the rules for your company.
Send your first tracked link today
Free for one seat. New workspaces get 14 days of the Team plan without a card.