Security is foundational,
not an afterthought.

When AI agents operate software on behalf of your users, security isn't a feature — it's the architecture. Every layer of Deck is built around isolation, encryption, and zero-trust principles.

SOC 2 Type II Certified SOC 2 Type II Certified
Data encrypted in transit and at rest Data Encrypted In transit & at rest
SSO SSO & SAML Access controls
GDPR Compliant GDPR Compliant
HIPAA Ready HIPAA Ready
PCI DSS Level 1 Compliant PCI DSS Level 1
Agent AIsolated VM
Agent BIsolated VM
Agent CIsolated VM
Agent DDestroyed

Every agent runs in complete isolation

Each session spins up a dedicated, ephemeral VM. No shared memory, no shared filesystem, no shared network. When the task completes, the VM is destroyed.

In transitTLS 1.3
At restAES-256
CredentialsPer-tenant keys
API keysHashed, never plaintext
Sensitive dataVault + tokenization

Encryption at every layer

All data is encrypted in transit with TLS 1.3 and at rest with AES-256. Credentials are stored in a PCI-compliant vault with per-tenant keys.

✓ Multi-factor authentication
✓ SSO / SAML support
✓ Role-based access controls
✓ Just-in-time privileged access
✓ Device posture verification
✓ Full audit trail

Zero-trust access controls

Only those who need access get it. Every access event is logged, monitored, and auditable. Internal access requires just-in-time approval.

Sandboxed execution

No lateral network access. Agents can only reach the target.

Action policies

Block deletions, cap spending, require approvals.

Session replay

Every session is recorded for full audit.

AI agent-specific safeguards

Agents operate in sandboxed VMs, actions are bounded by configurable policies, and sensitive operations require human approval.

PCI DSS Level 1

Deck is PCI DSS Level 1 compliant, validated through a Report on Compliance (ROC) completed by an independent Qualified Security Assessor (QSA). This is the highest level of PCI DSS certification and requires an external assessor to test each applicable requirement directly, rather than relying on a self-assessment.

This certification covers the infrastructure and controls in scope when Deck workflows handle payment card data, including:

  • Encryption of cardholder data at rest and in transit
  • Access controls and authentication for in-scope systems
  • Logging and monitoring of access to cardholder data environments
  • Vulnerability management and regular security testing
  • Secure credential storage and handling

The full Report on Compliance is available to customers and prospective customers under NDA.

Deck PCI DSS v4.0.1 Compliant 2026, assessed by Insight Assurance

Continuous compliance and monitoring

Our systems undergo continuous monitoring to proactively detect and prevent security threats. We maintain a thorough audit trail for all key actions, ensuring transparency and accountability.

Incident response

  • Documented response plan
  • Audited by PwC
  • Tested annually
  • Containment within hours

Penetration testing

  • Annual third-party pen tests
  • Continuous SAST & DAST scanning
  • CSPM monitoring
  • Findings triaged & remediated

Data retention

  • Customer data deleted at end of service
  • Backups permanently removed
  • No recoverable copies
  • Configurable retention policies

Infrastructure

  • Hosted on Google Cloud Platform
  • Subprocessors vetted against standards
  • SOC 2 compliant vendors
  • Region-specific data residency