Using XKey
Security & Data Handling
A practical overview for IT, security and procurement teams: what runs on the device, what goes online, and which provider assurances support XKey.
Effective date:
Where your data goes
PowerPoint editing commands run locally. XKey does not require presentation-file uploads for ordinary alignment, formatting and shortcut operations. Online features handle the account and operational information described below.
Local editing does not require a continuous connection. Sign-in, activation, license refresh, billing and update checks need connectivity; offline availability depends on the validity of the cached license and your plan.
| Feature | Processing | Information involved |
|---|---|---|
| Slide editing | Windows / PowerPoint | Presentation objects and local settings; ordinary editing runs on the device. |
| Accounts and licensing | XKey APIs / Supabase | Name, email, user/team/seat IDs, device details, license state and synchronized shortcut-usage counts. |
| Payments | Stripe Checkout / XKey APIs | Payment and billing details at Stripe; subscription, customer and entitlement records at XKey. Full card numbers are not stored by XKey. |
| Support | Resend / support mailbox | The name, email, subject and message you submit. Contact content is not duplicated in a Supabase contact table. |
| Diagnostics | Sentry / local logs | Identifiers, technical error context, IP/request metadata, performance traces and sampled Replay. |
| Standalone updates | GitHub Releases | Public version/package requests and download metadata, including IP addresses handled by the delivery provider. |
Application controls
XKey applies controls at the application and data boundaries, alongside the infrastructure controls supplied by its providers.
- Server-side authentication and team-ownership checks protect account and team actions. A team owner can manage membership and seats, but cannot rename another user’s global profile.
- Database row-level policies restrict user/tenant access, including authenticated shortcut-usage writes attributed to the signed-in user. Administrative credentials remain on the server.
- Hosted connections use HTTPS. Authenticated device/license API responses bypass the application service-worker cache.
- Support input is validated and encoded when rendered in HTML email. Payment entitlement is verified using Stripe state and signed webhook events, rather than trusting a return URL.
Provider certifications and reports
The table links directly to each provider’s own assurance statements, reviewed on November 6, 2026. ISO 27001 is an information-security management certification; SOC 2 Type II is an independent controls report; PCI DSS addresses payment-card security. Their scopes and evidence are different.
XKey does not hold an independent ISO 27001 certificate or SOC 2 report. A provider’s certification covers its stated services and scope; it does not certify XKey’s application, our configuration, your deployment or your organization’s compliance. Current certificates and restricted audit reports may require access through the provider.
Stripe’s cited page lists PCI and SOC assurance; no Stripe ISO certification is claimed here. Resend publishes SOC 2 Type II and states that it does not hold an ISO 27001 certificate.
| Provider / evidence | Role and data | Published assurance |
|---|---|---|
| SupabaseProvider evidence ↗ | Authentication; account, team, device, license and shortcut-usage records. | ISO/IEC 27001:2022 · SOC 2 Type 2 |
| VercelProvider evidence ↗ | Website and API hosting; network requests and operational metadata. | ISO/IEC 27001:2022 · SOC 2 Type 2 |
| StripeProvider evidence ↗ | Hosted checkout, payment details, subscription and billing records. | PCI DSS Service Provider Level 1 · SOC 1 / SOC 2 Type II |
| SentryProvider evidence ↗ | Error reports, performance traces and sampled website/session Replay. | ISO 27001 · SOC 2 Type 2 |
| ResendProvider evidence ↗ | Contact-form email delivery, including the submitted message and sender details. | SOC 2 Type II |
Diagnostic information
Signed-in web and embedded sessions can be associated with the Supabase user ID and email. Anonymous embedded sessions can use the hardware identifier; other browser sessions use a random tab-session ID. These help investigate failures and are not authentication credentials.
Diagnostics include errors and performance information. Sampled Sentry Replay can include page structure and interactions during normal visits or an error. SDK masking and blocking reduce captured content, but are not a promise that every potentially identifying detail is removed. Device/environment information may also appear in desktop logs.
Please keep passwords, tokens and confidential presentation content out of support submissions. If an event needs removal, contact support with the account or event reference so it can be reviewed through the relevant provider process.
Retention, deletion and processing locations
Sentry diagnostic events are retained for a maximum of 30 days under our current plan. Account, license and billing records support the service relationship and applicable recordkeeping needs. Support correspondence, other operational logs and backups have separate purposes and retention/deletion processes. Account closure is not an immediate purge of every provider, backup or mailbox.
Request access, correction or deletion through support@infiniticlips.com. We verify the request and review ownership, billing and legal constraints. Uninstalling XKey preserves local settings and does not cancel a paid subscription.
Providers and subprocessors can process data outside Japan, including in the United States and other countries. Database region selection alone does not determine the location of every authentication, billing, support or diagnostic operation. Confirm specific residency, retention and transfer requirements with us before procurement approval; this page makes no single-country hosting commitment.
Installation and update ownership
XKey targets Windows 11 x64 with Microsoft 365 desktop PowerPoint, including x86 and x64 Office. Deployment depends on the documented .NET Framework, VSTO and WebView2 prerequisites. Published MSI packages are signed.
The Intune MSI contains no self-updater: customer IT controls package approval, assignment and supersedence. The alternative Standalone MSI checks its selected Stable/Preview GitHub channel, verifies package identity/signature/hash and asks for user acceptance and administrator approval before installation. It waits for PowerPoint to close.
Application backend and update channel are independent settings. Uninstall preserves user data. Enterprise endpoint policies, prerequisite servicing and Windows/Office acceptance remain the customer’s deployment responsibilities; a local package check is not a substitute for an IT pilot.
For your security review
Contact support@infiniticlips.com with your deployment model, expected data, user/seat count and security questionnaire. We can clarify the current data flows and available installation documentation. Share sensitive review material through an agreed channel.
Confirm requirements for retention, processing locations, contractual data-processing terms, support and availability before purchase. Any customer-specific DPA, SLA or residency commitment must be agreed in writing; provider reports alone do not establish those commitments.
Report suspected vulnerabilities privately to the same contact with the affected version, impact and reproduction steps. Do not include passwords, access tokens or confidential slide content. This page is a product overview, not an independent audit or a certification.