Security
Command Deck connects to the services that run your business, so it's built to be trusted with them. Here's how, in plain English.
Read-only by design
Command Deck only looks. It cannot change your code, move money, refund payments or delete anything. The single exception is a Redeploy button that republishes your current live version, and it only runs when you press it and confirm.
Your keys are locked away
Every key you connect is encrypted (AES-256-GCM) the moment you save it, stored encrypted, and only unlocked on the server when needed. Keys are never sent to your browser, never shown again in full (only the last 4 characters), and never written to logs.
Least access
Setup guides ask for read-only permissions wherever the service offers them (GitHub, Stripe, Cloudflare, Supabase, Wix). Where a service has no read-only option we say so plainly, next to the key.
Only you can sign in
Sign-in is through GitHub and is locked to one named account. If your GitHub account uses two-factor authentication, so does Command Deck. Blocked sign-in attempts are recorded.
A full activity record
Every sign-in, key change, project change, redeploy and alert is recorded with the time, so you can see exactly what happened and when.
Alerts only go to you
Emails, texts and phone notifications go only to the addresses you set. Nothing is shared with anyone else.
Secure by default
All traffic is encrypted (HTTPS with HSTS). Pages can't be framed by other sites, and strict browser security headers are sent with every page.
Public status pages show only what you choose
If you turn on a status page for a product, it shows only whether the site is up and its uptime history. No keys, revenue, code or internal details.
Built by an auditor
Command Deck is designed around ISO 27001 principles: least privilege, encryption at rest and in transit, access control, logging and monitoring, and clear supplier boundaries.
Questions or a security concern? Email info@securityapproval.co.uk. Back to Command Deck