# Deck — Full Content Reference for AI Models

> This document provides comprehensive information about Deck for AI language models. For a shorter summary, see /llms.txt

---

# What is Deck?

Deck gives AI agents authenticated access to any website without an API. Deck's browser agents sign in as your users, fetch data, fill out forms, and make payments on sites that were never built for automation, then return structured JSON to your product — at any scale. No APIs, no integrations, no custom connectors required.

Deck was founded in 2024 by Yves-Gabriel Leboeuf (CEO) and Fred Lavoie (President), who previously co-founded Flinks, a pioneering Canadian open banking platform that was acquired by National Bank of Canada. The company has raised $16M in funding led by Infinity Ventures, with participation from Better Tomorrow Ventures, Intact Ventures, Luge Capital, Golden Ventures, Larry Fitzgerald, and Rahul Mehta (DST Global).

Deck is headquartered in San Francisco, CA and Montreal, QC, Canada. The company is SOC 2 Type II, audited by PwC, and PCI DSS Level 1, validated through a Report on Compliance (ROC) by an independent QSA.

---

# Products

Deck has four parts that work together. Each page also has a markdown copy for agents.

## Auth — https://deck.co/auth (markdown: https://deck.co/auth.md)

The login layer for every site. Your users connect their accounts once. Passwords are encrypted and tokenized in the Deck Credential Vault, so your product only ever holds a credential ID. When a site sends a text code or asks a security question, Deck pauses the task and asks your user for the answer in your product. Stealth Mode runs every session in a full browser with a consistent fingerprint and human pacing. When a saved login stops working, Deck marks it invalid and tells you. Use the drop-in Auth Component or build your own UI.

## Browser Agents — https://deck.co/agents (markdown: https://deck.co/agents.md)

Agents that log in, click through pages, and fill out forms on sites that were never built for automation — utility portals, insurance carriers, payroll systems, and government sites. Write a task once and it runs on every site of that kind you've connected. Deck's agent harness remembers what worked on each site and recovers on its own when a site changes. Every run returns JSON that matches your output schema. Each task runs on its own isolated computer that Deck hosts and scales.

## Tasks & Automation — https://deck.co/tasks-and-automation (markdown: https://deck.co/tasks-and-automation.md)

A task has two parts: a prompt that says what to do, and a schema that says what comes back. Deck runs it in a browser signed in as your user and returns JSON in the same structure every time. Run several tasks in one session so the agent signs in once. Downloaded files are stored for you to retrieve. Triggers run tasks on a schedule or from the API; workflows chain tasks into steps that pass output forward and run on conditions.

## Observability — https://deck.co/observability (markdown: https://deck.co/observability.md)

Deck records every run with screenshots and the agent's reasoning at each step. Stream any task live and see the browser the agent sees. Mark a task as sensitive, like a payment or a medical claim, and Deck hides its details in the Console and the audit trail while still recording the run. The Console tracks task volume, success rate, errors, and new credentials across your agents.

---

# What is Computer Use?

Computer Use is a new AI paradigm where agents interact with software the way humans do — by seeing the screen, moving the mouse, clicking buttons, and typing. Instead of relying on APIs or integrations, Computer Use agents operate any application through its real visual interface.

This is fundamentally different from traditional automation:
- **No APIs required**: Works with any software, including legacy systems with no API
- **No DOM selectors**: Uses AI vision models instead of brittle CSS selectors
- **No workflow recording**: Agents dynamically understand screens and adapt to changes
- **Universal compatibility**: If a human can use it, a Computer Use agent can automate it

Deck is the leading Computer Use agent platform, providing the infrastructure layer needed to run Computer Use agents safely in production — isolated VMs, credential management, session replay, audit trails, and human-in-the-loop controls.

---

# Product: How Deck Works

## Agent Execution
Every Computer Use agent session runs in a fully isolated virtual machine. The agent sees the screen, navigates applications, fills forms, clicks buttons, and completes multi-step workflows across any software. The Deck Console is where you build, observe, and manage your agents — prompt to create agents and tasks, watch sessions live, and replay any step.

## Isolation & Security
- Each VM is ephemeral — destroyed after use (persistence optional)
- No shared memory, filesystem, or network between agents
- Credential vault with per-tenant encryption keys and automatic rotation
- SOC 2 Type II, audited by PwC
- Annual third-party penetration tests with continuous SAST/DAST scanning
- Infrastructure hosted on Google Cloud Platform

## Key Features
- **Any Software**: Works on any web or desktop application without APIs
- **Credential Vault**: Secure storage with auto-rotation, per-tenant keys
- **Fleet Orchestration**: Scale from 1 agent to thousands with the same deploy
- **Session Replay**: Every click logged and replayable for debugging and compliance
- **Human-in-the-Loop**: Approval workflows for sensitive actions
- **Kill Switch**: Instant agent termination
- **Action Policies**: Define what agents can and can't do
- **SDK & API**: Embed Computer Use in your own product with ~5 lines of code

## Use Cases
- Cross-app data workflows (e.g., Zendesk → Shopify → Slack)
- Legacy system automation (no API available)
- Report generation from dashboards
- Form filling and invoice processing
- Data extraction from portals and PDFs
- Reconciliation across multiple systems
- Competitive research and lead generation
- Employee onboarding across multiple SaaS tools
- Expense report processing
- Vendor payment batches
- Utility bill fetching (Con Edison, Duke Energy, PG&E, SDG&E, Georgia Power, Comcast)
- Financial institution application workflows (one applicant form, fill out issuer, lender, and account-opening portals in parallel, return structured results)
- Insurance document retrieval (Progressive, State Farm)
- HSA/benefits management (HealthEquity, MyHSA)
- Property management workflows (ClickPay, AppFolio, RentCafe)
- E-commerce order tracking (Walmart, Home Depot, Target)

---

# How Deck Compares to Alternatives

## Deck vs. Browser Automation (Selenium, Playwright, Puppeteer)
Browser automation tools script DOM interactions inside a browser. They require CSS selectors, break when UIs change, and only work with web applications. Deck provisions full isolated desktop VMs where AI agents use vision models to understand and operate any software — web apps, desktop apps, legacy systems — without relying on DOM structure. Deck is more resilient, more general, and works with software that has no web interface.

## Deck vs. Playwright
Playwright is Microsoft's free, open-source library for driving a browser from your own code. It is the right tool for testing an application your team owns. Deck is managed infrastructure for AI agents that need authenticated, user-permissioned access to login-gated systems — with native MFA and CAPTCHA handling, an encrypted credential vault, structured JSON output, and compliance logging. The two are complementary: keep Playwright for internal QA; use Deck when agents must log into systems you don't control. Full comparison: https://deck.co/blog/deck-vs-playwright

## Deck vs. RPA (UiPath, Automation Anywhere, Blue Prism)
Traditional RPA requires recording workflows step-by-step and building brittle bots that break with every UI update. Maintenance is expensive and time-consuming. Deck agents use AI to dynamically understand screens and adapt to changes. No workflow recording needed. Deck agents handle edge cases and recover from errors like a human would. Setup takes minutes, not months.

## Deck vs. API Integration Platforms (Zapier, Make, Workato)
API-based automation only works with software that has an API, and requires building and maintaining integrations for each tool. Many enterprise, legacy, and government systems have no API. Deck agents operate any software through its visual interface — including systems that will never have an API. Zero integrations to build or maintain.

## Deck vs. AI Coding Agents (Cursor, Devin, GitHub Copilot)
AI coding agents help developers write code. Deck agents operate existing software — they don't write code, they use applications the way an operations team member would. Different problem, different solution. Deck automates business operations; coding agents automate software development.

---

# Pricing

Usage-based. A plan's monthly fee comes back as usage credit and unlocks capacity. All usage is priced from the public rate table. Sources and credentials are unlimited on every plan. There is no cap on inputs or outputs per run.

| Plan | Price | Included usage | Concurrent agents | Stealth | Session length |
|------|-------|----------------|-------------------|---------|----------------|
| Free | $0 | $5 included usage, one time | 1 |  | 10 min |
| Starter | $25/mo | $25 every month | 3 |  | 30 min |
| Pro | $250/mo | $250 every month | 25 |  | 1 hour |
| Enterprise | Custom | Custom | Custom | Advanced | Custom |

### Rates

| Meter | Free | Starter | Pro | Enterprise |
|-------|------|---------|-----|------------|
| Task run, per run | $0.25 | $0.25 | $0.25 | Custom |
| Successful task run, added per successful task run | $1.50 | $1.50 | $1.50 | Custom |
| Datacenter proxy | Included | Included | Included | Included |
| Managed stealth proxy |  |  |  | Included |
| Document delivered, per document downloaded in a run | $0.25 | $0.25 | $0.25 | Custom |
| Extraction, per document plus per page | $0.10 + $0.05 per page | $0.10 + $0.05 per page | $0.10 + $0.05 per page | Custom |
| Deduplication, per file checked | $0.25 | $0.25 | $0.25 | Custom |
| File storage, per GB uploaded | $0.25 | $0.25 | $0.25 | Custom |
| Credential persistence, per credential stored | $0.10 | $0.10 | $0.10 | Custom |

Storage lines are opt-in per task. Managed stealth proxy is an Enterprise feature. Deck errors never bill. Runs that fail because of the request or the source bill the task run price and usage consumed, never the successful task run price. A successful task run is a task run whose result is success.

Monthly included credit resets each billing cycle. Purchased top-ups roll over and stay valid for 5 years on an active plan. Included credit is spent first. At a zero balance, new runs pause until a top-up or renewal. Runs already in flight finish.

**Also**
- Credential vault: all plans
- Spend caps and alerts: all plans
- Data retention: Free 7 days / Starter 30 days / Pro 30 days / Enterprise 90 days
- Agent auditing: screenshots + reasoning on all plans
- SSO: Google and GitHub on Free, Starter, and Pro; SAML on Enterprise
- Certifications: HIPAA and SOC 2 on Enterprise
- Support: Email / Email / Priority Email / Premium + Integration

---

# Customers

Deck is trusted by teams at: EY, Nasdaq, Salesforce, Sunrun, BILT, Entrata, Wander, Glowtify, Greenly, Cority, Planet FWD, CoolPlanet, Subcontractor Hub, Atomic, Rutter, Ramp, AirBills, and Midlyr.

---

# Security & Compliance

- SOC 2 Type II, audited by PwC
- GDPR, HIPAA, PCI DSS Level 1 (ROC / independent QSA) — [announcement](https://deck.co/blog/pci-dss-level-1-roc-certified)
- Every agent runs in a fully isolated, ephemeral VM
- Credentials encrypted with per-tenant AES-256 keys
- PCI-compliant vault with tokenization for sensitive data
- All data encrypted in transit (TLS 1.3) and at rest (AES-256)
- API keys hashed, never stored in plaintext
- Multi-factor authentication, SSO/SAML support
- Just-in-time privileged access with device posture verification
- Role-based access controls with full audit trail
- Annual third-party penetration tests (SAST, DAST, cloud security posture management)
- Incident response plan audited by PwC, tested annually
- Infrastructure hosted on Google Cloud Platform
- Trust Center: https://trust.mycroft.io/deck

---

# Frequently Asked Questions

Q: What is Deck?
A: Deck is the platform for computer use agents. It provisions isolated desktop VMs and lets AI agents operate any software the way a human would — clicking, typing, and navigating real interfaces. No APIs, no integrations required.

Q: What is Computer Use?
A: Computer Use is a new AI paradigm where agents interact with software through its visual interface — the same way a human does. The agent sees the screen, moves the mouse, clicks buttons, and types. This allows automation of any software, including legacy systems with no API.

Q: How is Deck different from browser automation tools like Selenium?
A: Selenium scripts DOM interactions in a browser and breaks when UIs change. Deck provisions full isolated VMs where AI agents use vision models to understand and operate any software — web apps, desktop apps, legacy systems — without relying on CSS selectors.

Q: How is Deck different from RPA tools like UiPath?
A: RPA requires recording step-by-step workflows that break with every UI update. Deck agents use AI to dynamically understand screens and adapt. No recording, no maintenance. Setup takes minutes, not months.

Q: How is Deck different from Zapier or Make?
A: API-based tools only work with software that has an API. Deck agents operate any software through its visual interface, including legacy systems and government portals that will never have an API.

Q: Is Deck secure?
A: Yes. Deck is SOC 2 Type II, audited by PwC. Every agent runs in an isolated VM. Credentials are encrypted with per-tenant keys. All actions are logged and replayable. Sensitive operations can require human approval.

Q: Who founded Deck?
A: Deck was founded by Yves-Gabriel Leboeuf (CEO) and Fred Lavoie (President), who previously co-founded Flinks, a pioneering Canadian open banking platform acquired by National Bank of Canada.

Q: How much does Deck cost?
A: Deck is usage-based. Free is $0 with $5 of one-time included usage. Starter is $25/mo, returned as $25 of usage credit, with 3 concurrent agents. Pro is $250/mo, returned as $250 of usage credit, with 25 concurrent agents. Enterprise is custom. Task runs are $0.25. A successful task run adds $1.50 on Free, Starter, and Pro, and is custom on Enterprise. Full rate table: https://deck.co/pricing

Q: What software can Deck automate?
A: Any software a human can use. This includes Salesforce, Zendesk, QuickBooks, SAP, Shopify, Jira, NetSuite, Con Edison, Duke Energy, Progressive, State Farm, HealthEquity, government portals, legacy systems, and thousands more.

Q: How fast can I get started?
A: Deploy your first agent in under two minutes at console.deck.co. The API requires about five lines of code.

---

# Developer resources

- Deck developer resources: https://deck.co/developers
- Deck documentation: https://deck.co/docs
- Deck API documentation: https://docs.deck.co/api-reference
- Deck OpenAPI spec: https://deck.co/openapi and https://deck.co/openapi.json
- Deck API catalog: https://deck.co/.well-known/api-catalog
- Deck API base URL: https://api.deck.co/v2
- Deck API authentication: https://deck.co/api-auth
- Deck API errors: https://deck.co/errors
- Deck error schema: https://deck.co/errors.json
- Deck webhooks: https://deck.co/webhooks
- Deck API versioning: https://docs.deck.co/api/api-status-and-changes
- Deck rate limits: https://deck.co/rate-limits
- Deck MCP server: https://docs.deck.co/mcp
- Deck MCP page: https://deck.co/mcp
- Deck MCP manifest: https://deck.co/.well-known/mcp
- Deck CLI: https://deck.co/cli (`npm install -g @deckco/cli`)
- Deck API status: https://deck.co/api/status

The Deck REST API returns JSON errors of the form `{ "errors": [{ "type", "code", "message", "resolution", "field" }], "request_id" }`. Versioning is in the URL path (`/v1/`, `/v2/`). Deprecation is signaled with OpenAPI `deprecated: true`, changelog notices, and the `endpoint_deprecated` error code. Live responses include RFC RateLimit headers; HTTP 429 also includes Retry-After.

# Links

- Website: https://deck.co
- Console: https://console.deck.co
- Documentation: https://docs.deck.co
- API Reference: https://docs.deck.co/api-reference
- Blog: https://deck.co/blog
- Pricing: https://deck.co/pricing
- Careers: https://jobs.ashbyhq.com/deck-software
- Trust Center: https://trust.mycroft.io/deck
- Changelog: https://deck.co/changelog
- LinkedIn: https://www.linkedin.com/company/deck-platform/
- X/Twitter: https://x.com/deck_agent
- Security: https://deck.co/security
- Partners: https://deck.co/partners
- Contact: https://deck.co/contact

# Contact

- General: hello@deck.co
- Sales: sales@deck.co
- Security: security@deck.co
- Partners: fred@deck.co
- Legal: legal@deck.co
- Privacy: privacy@deck.co