Security
Five mechanisms, all of them things you can check: a signed link, a checksum, a licence certificate, gates that run on the delivered zip, and an order page that needs two things to open.
Pack zips do not live in the site's static folder. The only way to fetch one is /business/download/<pack> with an expiry and an HMAC signature that covers the pack id, its version and the expiry. No signature, a wrong version, or an expired link gets a 403; if the server-side signing key is missing the route refuses to serve at all rather than falling back to a public URL.
Every pack carries checksums.sha256 covering every file inside it, and the delivery manifest repeats the SHA-256 of each pack you bought. The download response also carries the checksum in a header, so a mismatch is visible without opening anything.
Your order produces a licence certificate: who it is licensed to, the tier, the seats, the packs and versions, the amount, the six licence clauses, and a checksum of the document itself. The delivery manifest and the receipt sit next to it.
Before a pack is published, the zip itself is put through seven gates: one clean package, it fills on your machine, the page count is the truth, nothing is missing on the page, the rebrand leaves no old brand colour, the checksums describe the real files, and the terms ship with the pack.
Opening an order requires the checkout session id and the email that paid for it. A session id alone shows nothing: the page asks for the email before it shows the packs, the licence or the download links.
The zip unpacks to exactly one top-level folder named after the skill, with every required member inside — no half-delivered pack.
The README command runs against the delivered zip on a bare python-pptx interpreter, with zero error-level issues: no overflow, no leftover template sentence, no empty title.
The template renders exactly as many pages as the catalogue claims, and a filled deck renders exactly as many pages as your content asked for.
Rendered pages carry no missing-glyph marks and no invisible Chinese characters, and no page fails the fidelity/overflow bench.
After the one-command rebrand, no colour of the original brand family is left anywhere in the file.
checksums.sha256 matches every file actually inside the zip, and nothing inside the zip is missing from the list.
A commercial pack must carry LICENSE.md with every promised clause — the page you read is the licence you get.
Order records are kept for a limited window for accounting and support, then deleted. Your licence terms do not expire with them — what you bought stays licensed.
Next
We send the pack, the licence terms and a sample built from your own material.