---
title: "Security · MetricDeck"
description: "How MetricDeck protects your accounts and data: read-only access, encryption, isolation between customers, and safe AI."
url: https://metricdeck.app/security
updated: 2026-10-01
---

Trust

# Security

You're trusting us with access to your clients' marketing accounts. Here's exactly how that access is limited and how the data is kept safe.

## Read-only, always

* MetricDeck only ever reads from Google Search Console, Google Analytics, Google Ads and OpenAI Ads. It never creates, edits, pauses or spends anything, and nothing in the app can.
* Search Console and Analytics use Google's read-only permissions. Google Ads has no read-only permission, so we request the standard one and use it only to read.
* You choose which properties and ad accounts each project reads, and can disconnect at any time.

## Encryption

* Google logins (refresh tokens) and OpenAI Ads keys are encrypted at rest with AES-256-GCM, decrypted only on our servers when a sync needs them, and never sent to your browser or written to logs.
* Everything travels over TLS, with HTTPS enforced (HSTS) on every page.

## Each customer's data is kept apart

* Every record belongs to one workspace, and every page and action checks that the signed-in person belongs to it before reading anything.
* The database can't be reached through a public API, and row-level security is on for every table.
* We run an automated test suite that tries to read and change other workspaces' data, and checks it can't.

## Signing in

* New accounts confirm their email with a 6-digit code before they're created. Codes expire after 10 minutes and allow 5 tries.
* Two-factor login with an authenticator app, with backups allowed.
* Changing your password asks for the current one and emails you a notice.
* You can delete your account and everything in it yourself, at any time.

## AI that can't make things up

* Our code calculates every number. The AI only writes about numbers it is given, and any sentence quoting a number we didn't give it is dropped before you see it.
* Only the figures and names a summary needs are sent to Anthropic, which doesn't train its models on them. Your data is never used to train any AI model.

## Website checks and shared reports

* When we check a site, we refuse to fetch private or internal network addresses, and re-check every redirect, so the checker can't be pointed at anything it shouldn't reach.
* A shared report link is a random 128-bit token, hidden from search engines. It can have a password (stored hashed; 10 wrong tries lock it for 15 minutes) and can be taken down at any time.
* Our pages can't be shown inside other sites (anti-clickjacking headers).

## Where it runs

The app runs on Vercel, the database and sign-in on Supabase in Mumbai, India (Amazon Web Services, through Supabase), and background syncing on Trigger.dev. The full list of providers is on our subprocessors page.

## Reporting a vulnerability

If you find a security problem, email [hello@metricdeck.app](mailto:hello@metricdeck.app?subject=Security) with "Security" in the subject. We'll reply within 3 business days and keep you updated until it's fixed. Please don't access other customers' data or disrupt the service while testing.

## Start with one client, free.

Connect Google and the first sync shows what changed, what it cost and what to do next. No card, and it never changes your accounts.

[Start free](https://metricdeck.app/signup) [See the live demo](https://metricdeck.app/demo)

Free for one client · No card · Read-only access