Security at Podium

Encryption in transit and at rest

Podium is served exclusively over HTTPS, and the browser is instructed to refuse insecure connections to the site. Your account data, presentations and uploaded slide images are stored by our managed cloud database and storage provider, which encrypts data at rest on its infrastructure.

• HTTPS everywhere, with HTTP Strict Transport Security enabled
• Database and file storage encrypted at rest by our cloud provider
• Content Security Policy and MIME-sniffing protections sent with every page

Your data is scoped to your account

Every table that holds your content carries row-level access rules enforced by the database itself, not just by the app. A request that is not authenticated as you cannot read or write your projects, folders, presentations, slides or subscription record — even if it reaches the database directly.

• Row-level security on every table containing customer data
• Access decisions made server-side against your verified session, never from browser state
• Administrative roles stored in a dedicated table and checked through a security-definer function, so a user cannot grant themselves elevated access

Accounts and authentication

Sign-in is handled by our managed authentication provider. Passwords are never stored by Podium in readable form, and sessions are issued as short-lived tokens that are refreshed automatically.

• Password hashing and session issuance handled by our authentication provider
• Signed-in password rotation available at any time from your account settings
• Leaked-password protection on sign-up and password change

Upload handling

Slide images are checked before they are accepted. Podium validates the declared file type against an allow-list and reads the file's leading bytes to confirm it really is an image, so a renamed file cannot be stored as slide content. Uploads are size-limited and stored in per-account paths.

Payments

Podium does not see or store your card details. Subscription checkout and billing are handled entirely by our payment provider. Podium only records which plan your account is on and the status of your subscription.

Report a vulnerability

If you believe you have found a security issue in Podium, email hello@usepodium.co with the subject line "Security". Include the steps to reproduce and, where relevant, the affected URL. Please give us a reasonable window to investigate and fix the issue before disclosing it publicly. We read every report and will acknowledge yours.

What this page does not claim

Podium is an independent product and has not undergone a third-party security audit or certification. Nothing on this page should be read as a claim of SOC 2, ISO 27001, HIPAA, PCI or any other certification. If your organisation requires formal assurance before adopting a tool, tell us what you need and we will be straight with you about what we can and cannot provide.