Built to hold a passport.
Your renters trust you with their passports, licences and signatures. Here is how DECK keeps them safe, and what we are doing next.
SOC 2 Type 1 in progress, started October 2026
01 / Encryption
Encrypted before it is stored.
Passport, Emirates ID and driving licence numbers never sit in the database as plain text. DECK encrypts them itself, and finds a customer by number without reading a stored one.
- AES-256-GCM. Document numbers, document copies, signed agreements and your government sign-ins are encrypted by DECK before they are stored.
- Found by fingerprint. A search by document number compares a one-way fingerprint, never the number itself.
- Encrypted on the way. Everything in transit runs over TLS, from your browser to our servers and beyond.
- Encrypted at rest. Everything else is encrypted by the storage it sits on.
02 / Isolation
Every company on its own.
Each rent a car company's data is walled off inside the database itself. A request from your account can only ever reach your rows, and DECK's own server cannot switch that off.
- Owner and team. Each person signs in with their own account. Company settings, the Salik, Darb and TARS connections, and deleting a car or a customer are for the owner.
- Sign-in codes that expire. Six digits, valid for five minutes, five tries. Passwords are kept only as one-way hashes, and sign-in attempts are rate limited.
- We do not look. Only DECK's own engineers can reach the systems, and only to support you or keep DECK running.
03 / Network
One way in.
DECK runs on AWS infrastructure. Every request passes through a network security layer that stops attacks before they reach us, and a request that tries to go around it is refused.
- No open door. The servers have no remote login open to the internet.
- No stored keys. Servers and deployments use short-lived credentials, and secrets are kept encrypted in a managed vault, not in code.
- Watched all the time. DECK is checked from outside, around the clock.
04 / Backups
Locked for 30 days.
Every night the database is encrypted and copied to a second region, where nobody can delete it for 30 days, not even us. Once a month the newest copy is restored on its own and checked.
- Locked, not just stored. A backup cannot be changed or deleted before its 30 days are up.
- Tested every month. The newest backup is restored into a separate database and its counts are checked against the original.
- Documents kept twice. Every scanned or uploaded document is copied to a second region.
05 / SOC 2
Next: an independent audit.
SOC 2 is an independent audit of how a company protects its customers' data. We are preparing for a Type 1 audit, which checks that our controls are designed well and in place. We started in October 2026, so you will not have to take our word for any of this.
- Started in October 2026. We are writing down how we work, and showing that we work that way.
- Checked from outside. An independent auditor will check that the controls are in place, not just read our documents.
- The report, on request. Once it is issued, customers can ask us for the report.
Questions owners ask.
Is DECK SOC 2 certified?
Where is our data kept?
Can people at DECK see our customers?
Is our data used to train AI?
What happens to our data if we leave?
Tell us first
Think you have found a security problem in DECK? Write to us with what you found and how to see it again. A person reads every report.