Security
Security at SignalDeck
How authentication, data handling, AI, provider connections, and audit work in the product, and which compliance reports do not exist yet.
Posture
Built for the security review you have to pass.
We list what is in place and what is not. If your security team has a questionnaire, send it and we will answer it.
- Auth
- Password + OIDC
- Email and password, magic link, Google, or Microsoft
- RBAC
- Route-level
- Enforced before handlers
- Tokens
- Encrypted
- Provider-scoped keys at rest
- Audit
- Logged
- Sensitive actions are audited
Access control
Who can do what, enforced server-side.
Workspace-scoped RBAC
Every resource belongs to a workspace. Roles are granted per workspace and checked on the server before a request is handled. A user with no role in a workspace cannot read or query its data.
Sign-in with hashed passwords, magic links, or Google/Microsoft
Sign in with your email and password (hashed with scrypt, rate-limited, and locked for 15 minutes after repeated failures), an email magic link, or a Google or Microsoft account. Sessions are stored server-side and can be revoked, and changing your password signs out your other sessions. SAML SSO and SCIM provisioning are Enterprise roadmap items, not shipped features.
Scoped, hashed API keys
API keys are scoped (read, write, ai, billing, webhook, admin), hashed at rest, and never re-displayable after issuance. Keys can be rotated or revoked from the developer settings.
MCP runs inside RBAC
Agent tool calls inherit the scopes of the key or session that started them. An agent cannot do more than its caller is allowed to, and destructive actions still need explicit confirmation.
Data handling
Encryption, isolation, and clean exits.
Provider tokens encrypted at rest
OAuth tokens are encrypted with provider-scoped keys before they are stored and are never written to logs. Decrypted access is limited to the workspace that owns the connection.
Tenant isolation, enforced server-side
Tenant scoping is applied on the server to every query, not added by the browser. An organization admin has no path into another organization's data.
Media virus scanning and processing
Uploaded assets are scanned, processed asynchronously, and tagged with their processing state. Files that fail scanning are quarantined and surfaced to the uploader, not silently passed through.
Export and deletion workflows
Workspace and organization owners can request an export of posts, approvals, audit events, and media manifests. Deletion keeps an audit record of the deletion itself.
AI safety
AI assists. People approve.
AI drafts, humans accept
AI helps draft, rewrite, summarize, and triage. It cannot publish, reply, delete, or block until a person accepts the action, and generated content stays labelled as AI output until then.
Confirmation gates on destructive actions
Deletes, role changes, key rotations, and bulk operations need an explicit confirmation whatever the role. Agents can propose; a person or a signed automation confirms the irreversible step.
Memory respects workspace boundaries
Brand voice, campaign memory, and any other context used to ground AI output belong to one workspace and are not shared with others, even for a user who belongs to several.
No customer data in training
We do not use customer workspace content (posts, drafts, approvals, inbox messages, analytics) to train foundation models.
Provider connections
Official OAuth and encrypted tokens.
Official OAuth only
Every supported channel connects through the platform's official OAuth flow. No shared passwords and no scraping. If a provider does not offer a capability through OAuth, the connection screen says so instead of asking for credentials.
CSRF-protected state
OAuth state is signed on the server and verified on callback. Tampered or replayed state is rejected, so a callback cannot attach to a session the user did not start.
Reconnect without losing history
When a token expires or is revoked at the provider, reconnecting keeps the posts, receipts, and metrics already tied to that account.
Capability detection on connect
On connect, SignalDeck records what the provider allows (publishing, inbox, metrics, refresh) so the product only offers actions the platform will accept.
Network and logging
Transport, signing, and what we don't log.
Encrypted in transit
The site, the app, and the API are served over HTTPS.
Signed outbound webhooks
Outbound webhooks carry an HMAC signature and a delivery ID, and a delivery can be replayed if your endpoint was down.
Rate-limit context
Limits apply per organization, per API key, and per anonymous caller, are documented, and are returned in response headers.
Logging without secrets
Application logs exclude provider tokens, API key secrets, credentials, and media contents. Audit logs record metadata, not payloads, by default.
Compliance status
What we have, and what we will not claim early.
This page will not present SOC 2, ISO 27001, HIPAA, or GDPR certification, a completed penetration test, or an availability commitment until the underlying report or contract exists.
SOC 2
SignalDeck holds no SOC 2 attestation and has no audit report today. This page will link a report only after an independent audit is complete.
ISO 27001
Not certified. We will not describe controls as ISO-aligned until an assessor has reviewed them.
Penetration testing
No third-party penetration test report is published yet. We won't claim a clean pentest until a real one exists.
HIPAA / GDPR / DPF
SignalDeck does not process health data and does not sign BAAs. Data-protection terms are agreed during procurement; certification claims wait on real legal review.
FAQ
Procurement questions.
Where can I get a current security packet?
Email [email protected] from your work domain. We answer questionnaires and share the subprocessor list.
How do you handle data residency?
Production runs on Microsoft Azure in a single region. Regional residency is not offered today; if residency is a procurement gate for you, talk to us before you buy.
Can I get an MSA, DPA, or BAA?
Contract terms such as an MSA or DPA are handled during Enterprise procurement. SignalDeck does not sign HIPAA BAAs.
What happens to my data if I cancel?
Export what you need before you cancel. Retention and deletion terms are written into your agreement, and deletion is recorded in the audit log.
How do I report a vulnerability?
Email [email protected] with reproduction details. We coordinate disclosure timing with you.
Talk to security
Bring your checklist.
Questionnaires, the subprocessor list, and architecture questions: email [email protected] from your work domain.