Slidewise Security Audit

Introduction 

This document provides a comprehensive overview of the security-related aspects of the Slidewise PowerPoint Add-in. It is designed to answer common questions posed by security analysts when evaluating or deploying the software. If additional information is required, please contact us via Neuxpower Support.

1. Organizational Security Practices 

Slidewise is developed and supported by a very small team, and as such, formalized processes in some areas are not applicable. Key organizational security practices are outlined below:

• Employee and Contractor Training: Employees and long-term contractors are not required to take annual information security training.

• Security Disclosure Program: Neuxpower does not have a formal security disclosure program.

• Third-Party Vendor Standards: Slidewise operates independently without reliance on subprocessors.

• Cyber Defense Program: Neuxpower does not have a formal cyber defense program in place, including vulnerability management, incident response, or engineering policies.

• Security Operations Center: Neuxpower does not maintain a 24x7 manned security operations center.

• Risk Management: There is no documented risk management process.

• IT Audits: No independent IT audit has been conducted in the last 12 months.

• Security Testing: We conduct internal testing and secure code reviews during the development lifecycle. However, no external penetration testing or formal vulnerability assessments have been performed on the solution in the last 12 months.

• Compliance Standards: Neuxpower does not formally adhere to any specific compliance or security standards.

2. Technology Stack and Components

Slidewise is built as a Microsoft Office VSTO (Visual Studio Tools for Office) Add-in. It is written in C# targeting the .NET Framework. It leverages the Microsoft Open XML SDK and COM Interop to read and manipulate PowerPoint files.

3. Code Signing and Integrity Controls

To ensure the authenticity and integrity of the add-in against tampering:

• Digital Certificates & Malware Verification: Slidewise is signed using a digital certificate issued to Neuxpower, which ensures the code has not been tampered with since we built it. We use SignPath to sign the components, and this process also verifies that the code contains no known viruses or malware at the time it is signed. All executable components, including the installer (.msi/.exe), VSTO deployment manifests (.vsto), and application assemblies (.dll), are digitally signed.

• Update Mechanisms: The 'Check for updates' process only notifies the user of a new version. The application does not auto-download or silently execute payloads. Any subsequent download and installation require the user to execute the digitally signed installer, ensuring the update's integrity.

4. Data and Communication 

Slidewise is designed with privacy and minimal communication in mind:

• Registration key verification: The software does not connect online to verify licensing; the license is entirely contained within the local key.

• Personal Data Usage: The application stores the user’s name in the registry of the computer operating system. No other personal data is used, stored, or processed, and no information is transmitted back to Neuxpower.

• Export-Controlled Technology: Slidewise does not use, store, or process export-controlled technology.

• Network Isolation: Slidewise processes all files locally on your machine without requiring internet access for its core functionality.

• Communication with Servers (Update Checking):

  • Checking for updates does not transmit any telemetry or information beyond standard web request data (e.g., the user's IP address).
  • When a newer version is available, Slidewise offers a redirect link to the Neuxpower site. This URL explicitly appends:
    • The version number of the current Slidewise installation.
    • The user's OS architecture (32-bit or 64-bit) to route them to the correct installer package.
    • The current license state (whether or not the product is operating in "free mode"). 

5. Safe File Processing & Storage

Slidewise performs deep inspection and manipulation of PowerPoint files (.pptx, .pptm, .potx) using Office Open XML manipulation.

• File Integrity: Files remain in their original file format. All manipulations strictly adhere to the Open XML standard to prevent document corruption. Slidewise operates entirely on the local machine; no presentation data or file contents are ever uploaded, cached remotely, or processed by cloud services.

• Temporary File Handling: Slidewise only utilizes temporary files when exporting files as images. Temporary files are written to the user's temporary directory, as determined by standard Windows APIs (this correctly accounts for the %TMP% environment variable being prioritized over %TEMP%). The application creates only one temporary file at a time, which is deleted immediately after use. In the worst-case scenario (e.g., PowerPoint crashes unexpectedly or a power failure occurs during export), a single temporary image file may remain on disk.

• Cloud Storage Compatibility: Slidewise fully supports presentations stored in Microsoft SharePoint, OneDrive, and Microsoft Teams, provided they are opened within the desktop version of Microsoft PowerPoint. (Note: Slidewise is a VSTO add-in and does not function in PowerPoint for the Web). For technical details regarding synchronization with cloud locations, refer to our guide on Resolving Unsupported Cloud Location Errors.

6. Registry Changes and Deployment

Slidewise modifies the registry during installation to register the VSTO add-in with Microsoft PowerPoint and to store user preferences and licensing information.

Registry & Add-in Registration

• Machine-wide Installation: Slidewise is always installed machine-wide. The COM add-in is registered strictly under HKEY_LOCAL_MACHINE (it does not use HKEY_CURRENT_USER).

• 32-bit Office Support: On 64-bit Windows machines, the add-in is concurrently registered under HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node to support 32-bit editions of Office.

• Per-Machine Licensing: The application reads from (but does not write to) HKEY_LOCAL_MACHINE\SOFTWARE\Neuxpower\Slidewise to verify machine-level licensing status.