Security
Every part of Deck is built to keep your data and your users’ logins safe. What your users share with you stays between you and them.
Passwords stay in the vault
Credentials are tokenized in Deck Vault the moment your user submits them. Your product only holds a credential ID, so passwords never reach your database, your logs, or an API response.
Tokenized on write
Secrets are vaulted before a credential is saved. If vaulting fails, nothing is stored.
Never logged or returned
Secrets are scrubbed from logs, and no API endpoint returns them.
Deleted for good
Delete a credential and its secrets and saved login state are gone permanently.
Independently audited
Our controls are tested by outside assessors, not just written down. Reports, policies, and our subprocessor list are in the Trust Center.
Visit Trust CenterSOC 2 Type II
Audited by an independent CPA firm.
PCI DSS Level 1
Validated by a Qualified Security Assessor.
HIPAA
Safeguards for protected health information.
GDPR and PIPEDA
Privacy controls for personal data from the EU and Canada.
Built for card data
Deck is PCI DSS v4.0.1 Level 1 compliant, the highest level there is. An independent Qualified Security Assessor tested each requirement directly for our Report on Compliance, so agents can pay bills, add cards, and switch payment methods on your users’ behalf.
- Cardholder data encrypted at rest and in transit
- Access controls on every in-scope system
- Logging and monitoring of the card data environment
- Regular vulnerability scans and security testing
The Attestation of Compliance is in the Trust Center. The full Report on Compliance is available under NDA.
Every run is contained
Every task run executes in a session: an isolated compute environment Deck provisions on demand and tears down after 10 minutes idle.
Clean sessions
Sessions boot from a clean browser. Only a credential’s saved login state carries over, encrypted with AES-256-GCM.
Credential scoping
Each credential is bound to one source and leaves the vault only to authenticate a session.
Interaction pauses
MFA pauses the run for up to 5 minutes while your user answers. Unattended runs can fail fast instead.
Screenshot trail
A screenshot roughly every 5 seconds, each paired with the agent’s reasoning trace, kept for 15 days and available through the API.
Sensitive data stays out of sight
Traffic is encrypted with TLS and stored data with AES-256. For card numbers, account numbers, and government IDs, you can go further.
Tokenized inputsEnterprise
Mark fields like card numbers, and they go into the vault instead of the run record.
Payload encryptionEnterprise
Task inputs and outputs come back encrypted with a key you hold and decrypt on your side.
Sensitive tasks
Hide the live view, screenshots, and reasoning in the Console for runs on banking or payroll portals.
Limited retention
Run data expires on a schedule set by your plan, and you can delete files and credentials at any time.
Access on your terms
Decide who on your team can reach Deck, and where Deck’s traffic comes from.
Enterprise SSOEnterprise
Sign in through Okta, Microsoft Entra ID, Google Workspace, or any SAML or OIDC provider.
Directory SyncEnterprise
Add and remove members from your identity provider over SCIM.
Roles
Admins manage API keys, billing, and settings. Members run the day-to-day work.
Static IPsEnterprise
Run tasks from a fixed IP range for sources that only accept allowlisted traffic.
How we run security
Our team reviews security continuously, and outside testers check our work.
Penetration testing
Third-party testers probe the platform every year, and findings are tracked until they’re fixed.
Incident response
A documented plan for detecting, containing, and reporting security incidents.
Vendor review
Subprocessors are assessed before they handle customer data, and each one is listed in the Trust Center.
Responsible disclosure
Found a vulnerability? See our disclosure program.