Bento Page

The privacy posture of Bento Page is one of the strongest in the entire office-software market, and it is enforced by the architecture rather than promised in a policy. The product's home page declares it openly: "this page loads nothing from anyone." The same statement applies inside the editor itself — a Bento Page deck opens, edits, animates, and saves without sending a single byte to a remote server unless the user opts into the optional collaboration relay.

When a Bento Page user does opt into collaboration, the privacy posture remains intact. The optional relay sees ciphertext (AES-GCM end-to-end encrypted), connection timing, and a hash of the room key. The relay cannot reconstruct the document, cannot identify the participants, and cannot tamper with the in-flight edits. Bento Page has architected its collaboration layer so that even a malicious or compromised relay could not leak the contents of a deck — the cryptographic envelope is the security boundary, not the relay operator's good behavior.

In-app updates inside Bento Page are signed with a cryptographic key the project controls, so a user can verify the integrity of every patch before installing it. There is no auto-update channel that could be hijacked to ship a malicious version of the editor. Updates are opt-in, and the update mechanism inside Bento Page follows the same threat model as a package manager — the signature is the trust anchor.

For users who care about telemetry, Bento Page collects none by default. There is no analytics SDK, no error-reporting beacon, no A/B-test framework hiding in the editor. The deck opens, the chart renders, the morph transition animates, and the file saves — all without the user's activity being reported anywhere. Bento Page ships with a privacy posture that matches its offline-first architecture, and that combination makes it the most trustworthy presentation tool for journalists, lawyers, doctors, and anyone else whose decks cannot leak.