Skip to content
Deckbell

Trust

Security at Deckbell

Last updated: November 4, 2026

Your team’s issues, conversations and code reviews live in Deckbell, so we take keeping them safe seriously. This page explains where your data is stored, how it is protected, the security controls you have in your workspace, and how to report a vulnerability to us.

1. Where your data is stored

Deckbell’s servers and database are hosted by Hetzner in Germany (Nuremberg). Uploaded files, such as images, videos and issue attachments, and workspace exports are stored in Cloudflare R2 under its EU jurisdiction, so they stay in the EU. Your account and workspace content are stored in the EU.

Some of the services we rely on, such as the AI provider that runs agents, process data in other countries. They are listed, with what each one does, in our list of service providers.

What “EU data residency” means

Your account and workspace content, and our backups of them, are stored only in the EU. Deckbell is operated from Azerbaijan, and our administrators access the data from there when needed to run, secure and support the Service (see Access by our team). When an agent runs on Deckbell, the content it works on is processed by our AI provider in the United States. Push notifications are delivered through Apple, Google and Microsoft.

2. Network and encryption

  • Cloudflare in front of everything. All traffic to deckbell.com, app.deckbell.com and api.deckbell.com passes through Cloudflare, which protects the Service against denial-of-service attacks and bots before requests reach our servers.
  • Encryption in transit. Deckbell is only served over HTTPS, with TLS 1.2 or later; plain HTTP requests are redirected to HTTPS, and HSTS tells browsers never to use plain HTTP. The connection between Cloudflare and our servers is encrypted too, and Cloudflare checks our servers’ certificate. Live updates, chat and the Deckbell apps use the same encrypted connections.
  • Huddles and calls. Audio, video and screen sharing are relayed in real time through Cloudflare’s encrypted WebRTC network. They are not recorded or stored.
  • Encryption at rest. The database is stored on an encrypted volume whose key is kept off the server, and files in Cloudflare R2 are encrypted at rest. Secrets that Deckbell holds for you, such as your own AI provider key, integration access tokens and import tokens, are encrypted in our database with a key kept separately from it.
  • Passwords and tokens. Passwords are stored only as salted hashes (bcrypt), never in readable form. For API tokens we keep only a fingerprint, so a token is shown to you once and can’t be read back.

3. Backups and availability

The database and server files are backed up every night, encrypted before they leave the server, to Cloudflare R2 storage in the EU. Backups are kept for 30 days and then overwritten, and we have tested restoring from them. Uploaded files are stored in Cloudflare R2 rather than on our servers.

We monitor the Service around the clock, including that backups keep arriving, and publish its current state at status.deckbell.com.

4. Signing in

Every plan, including Free, gets these sign-in protections:

  • Passwordless by default. You sign in with a 6-digit code emailed to you, which expires after 10 minutes. Passwords and “Sign in with Google” work too.
  • Passkeys. Sign in with Touch ID, Face ID, Windows Hello or a hardware security key.
  • Two-factor authentication. Add a code from an authenticator app, with recovery codes. Once it’s on, Deckbell asks for it whichever way you sign in, so an emailed code alone never gets anyone into your account.
  • Confirm it’s you. Sensitive changes, such as turning off two-factor authentication, managing passkeys, changing your email address, transferring ownership or deleting your account, ask you to confirm your identity again first.
  • Your devices. See where you’re signed in under Settings → Security & access and sign other devices out. Repeated wrong passwords are slowed down to stop guessing.

How to set these up is explained in Signing in.

5. Access control in your workspace

  • Roles. Each member is an Owner, Admin or Member, and the role decides what they can manage. Admins can’t change other admins or the owner. See Members & roles.
  • Deactivating people. When someone leaves, deactivate them: they lose access at once, and their history stays in place.
  • API tokens. Tokens have scopes and an optional expiry date, can never do more than their owner’s role allows, and work in one workspace only. Owners and admins can see and revoke everyone’s tokens. See API.
  • AI agents. An agent can only reach the GitHub repositories you attach to it. Agents run on models from Anthropic, which does not use content sent through its API to train its models, and we don’t use your content to train AI models either.

On the Business and Enterprise plans you also get:

  • Audit log (Business and Enterprise): who invited, removed or changed the role of whom, changes to boards, labels and security settings, data exports, SSO sign-ins and more, with filters by action and person.
  • Message retention (Business and Enterprise): delete chat messages older than a period you choose, automatically.
  • Single sign-on (SAML) (Enterprise): sign in through Okta, Microsoft Entra ID, Google Workspace, OneLogin or another identity provider, on domains you verify, and optionally require it for everyone at those domains.
  • SCIM provisioning (Enterprise): your identity provider adds, updates and deactivates members for you.
  • Allowed email domains (Enterprise): only people with an address at your domains can be invited or join.
  • Legal hold (Enterprise): pause retention deletion and stop messages being edited or deleted, for example during an investigation.

All of these are explained in Security & compliance and SCIM provisioning.

6. Your data, export and deletion

  • Export. On the Enterprise plan, owners and admins can download the whole workspace as a ZIP of JSON files, including issue attachments. Download links work only for the person who asked, for a few minutes, and exports are deleted after 7 days.
  • Deleting your account. You can delete your account yourself in the app; see Delete your account.
  • Deleting a workspace. When an owner deletes a workspace, its data is deleted within 30 days, and from backups within a further 30 days.
  • AI provider. Content an agent works on is deleted from our AI provider within 30 days, except content its automated safety systems flag for review, which it may keep for up to 2 years.
  • No selling, no ads, no AI training. We don’t sell your data, use it for advertising, or use your workspace content to train AI models.

Imported data is handled carefully too: the API tokens and export files you give us to import from Slack, Linear, Jira or ClickUp are deleted as soon as the import finishes.

7. Payments

Payments are handled by Paddle, our merchant of record. Your card or other payment details go straight to Paddle; Deckbell never receives or stores your card number. Webhooks from Paddle are signed, and we only accept them from Paddle’s published addresses.

8. Access by our team

Only a small number of authorised administrators can access the production systems, with the least access they need, and only when needed to run the Service, fix a problem, keep it secure, or when you ask us to (for example in a support request). Nobody at Deckbell reads your workspace content otherwise.

Our administrators work from Azerbaijan. They reach production systems only over encrypted connections.

9. Privacy, GDPR and our DPA

How we collect and use personal data is described in our Privacy Policy. For business customers, our Data Processing Agreement sets out how we process personal data in your workspace on your behalf under the GDPR, including our subprocessors and how we notify you of a security incident. Its annex lists our technical and organisational measures in detail.

If your organisation needs a security questionnaire answered, email support@deckbell.com.

10. Reporting a vulnerability

If you believe you’ve found a security vulnerability in Deckbell, please email security@deckbell.com with a description, the steps to reproduce it, and the impact you think it has. We will confirm that we received your report, keep you updated while we fix it, and credit you if you’d like.

While you investigate, please:

  • only test against your own accounts and workspaces, and never access or change other people’s data;
  • avoid anything that degrades the Service for others, such as denial-of-service tests, spam or social engineering;
  • give us a reasonable time to fix the issue before you tell anyone else about it.

If you act in good faith and follow these guidelines, we won’t take legal action against you for your research. We don’t run a paid bug bounty programme at present.

If you think your own account has been compromised, change your sign-in method, sign out your other devices and email support@deckbell.com straight away.