Security

Read-only, always

• MetricDeck only ever reads from Google Search Console, Google Analytics, Google Ads and OpenAI Ads. It never creates, edits, pauses or spends anything, and nothing in the app can.
• Search Console and Analytics use Google's read-only permissions. Google Ads has no read-only permission, so we request the standard one and use it only to read.
• You choose which properties and ad accounts each project reads, and can disconnect at any time.

Encryption

• Google logins (refresh tokens) and OpenAI Ads keys are encrypted at rest with AES-256-GCM, decrypted only on our servers when a sync needs them, and never sent to your browser or written to logs.
• Everything travels over TLS, with HTTPS enforced (HSTS) on every page.

Each customer's data is kept apart

• Every record belongs to one workspace, and every page and action checks that the signed-in person belongs to it before reading anything.
• The database can't be reached through a public API, and row-level security is on for every table.
• We run an automated test suite that tries to read and change other workspaces' data, and checks it can't.

Signing in

• New accounts confirm their email with a 6-digit code before they're created. Codes expire after 10 minutes and allow 5 tries.
• Two-factor login with an authenticator app, with backups allowed.
• Changing your password asks for the current one and emails you a notice.
• You can delete your account and everything in it yourself, at any time.

AI that can't make things up

• Our code calculates every number. The AI only writes about numbers it is given, and any sentence quoting a number we didn't give it is dropped before you see it.
• Only the figures and names a summary needs are sent to Anthropic, which doesn't train its models on them. Your data is never used to train any AI model.

Website checks and shared reports

• When we check a site, we refuse to fetch private or internal network addresses, and re-check every redirect, so the checker can't be pointed at anything it shouldn't reach.
• A shared report link is a random 128-bit token, hidden from search engines. It can have a password (stored hashed; 10 wrong tries lock it for 15 minutes) and can be taken down at any time.
• Our pages can't be shown inside other sites (anti-clickjacking headers).

Where it runs

The app runs on Vercel, the database and sign-in on Supabase in Mumbai, India (Amazon Web Services, through Supabase), and background syncing on Trigger.dev. The full list of providers is on our subprocessors page.

Reporting a vulnerability

If you find a security problem, email hello@metricdeck.app with "Security" in the subject. We'll reply within 3 business days and keep you updated until it's fixed. Please don't access other customers' data or disrupt the service while testing.