Loading
Trust & Security
Your business, your data, your accounts.
Before you trust us with how your business runs, you should know what you own, who can reach your systems, where your data is stored and how it's protected. Here it is, in plain English.
Ownership
What's in your name.
Everything we build for you is yours from the first day, not when the project ends.
Your code
The source code lives in your own GitHub account from day one, not in ours.
Your data
Your customers, jobs, files and records belong to you and are stored in your own cloud project.
Your cloud accounts
Hosting, database and sign-in run in your own Google Cloud account, opened in your name from day one.
No exit fees
If we part ways, you keep everything and your software keeps running. There is nothing to buy back.
No lock-in by design
It's built on mainstream, widely used technology, so any qualified developer can pick it up.
Our people
A 100% U.S.-based, veteran-owned team.
You'll never be handed off to a team you can't reach. Here's who works on your system, and how access is handled.
100% U.S.-based team
Everyone who designs, builds, supports or touches client data works in the United States. We don't use offshore subcontractors.
Veteran-owned
Decrypted Tech is a veteran-owned company, run with the discipline and accountability that come with it.
The same people, start to finish
The people on your discovery call are the people who design your system, build it and support it after launch.
Named access only
Our access to your systems is tied to named accounts and removed when no longer needed.
Headquartered in Oklahoma
Founded in 2019. We keep U.S. business hours (Mon–Fri, 8 a.m.–5 p.m. Central) and work with businesses across the country.
Where your data lives
Your data is stored in U.S. data centers.
In your own Google Cloud account. When a feature needs an outside service, this page says which kind.
Stored in U.S. data centers
Your database and files are stored in U.S. data centers, on Google Cloud.
In your account, not ours
Your data sits in your own Google Cloud project, separate from every other business we work with.
Some services handle text to do their job
When an AI feature drafts something or your system sends an email, the text it needs goes to that provider. Both are listed below.
How your software is protected
Security built into the software, not bolted on.
These protections are part of the back offices and customer portals we build.
A sign-in for every user
Everyone who uses your back office signs in with their own account.
Role-based access you control
You decide what each role can see and change. Edits to a role take effect right away.
Rules enforced on the server
Access rules run on the server, not just in the screen, and automated tests check that each role reaches only what it should.
An activity log
Sensitive actions are recorded: who did what, to which record, and when.
Customer portals stay separate
Customers who sign in to a portal see their own projects, files and messages, and no one else's.
Private files stay private
Private files open only for signed-in users with access, never by a public link.
Access you can switch off
Disable a portal account and its sign-in is turned off and its sessions are revoked.
U.S.-hosted
The software runs on Google Cloud in U.S. regions, inside your own account.
AI & your data
What happens when the AI reads your data.
AI drafts inside your system, on your own records. Here's exactly where the text goes.
What gets sent
To write a draft, an AI feature sends the text it needs (a question, a document excerpt, the record it's working on) to an AI model provider.
No training on your data
The AI model providers we use don't train their models on business API data.
Your documents stay in your account
The manuals, plans and records the AI reads are stored in your own cloud project.
A person approves
AI drafts; your team decides. A person on your team approves anything important before it goes out.
Services we rely on
The outside services in the picture.
Which of these your system uses depends on what it does. Each one handles data to do its own job.
Cloud hosting
Google Cloud (Firebase)
Runs your website, database, files and sign-in, in your own account.
AI model provider
Our own tools use Anthropic
Turns requests from your team into drafts. Used only by the AI features.
Email delivery
An email delivery provider
Sends the emails your system writes, like notifications and replies.
Card payments
A card processor
Processes card payments, only where your system takes them.
What we don't claim
We are not SOC 2 certified. Here is what we do today.
- We don't hold SOC 2, ISO 27001 or any other security certification today.
- Google publishes certifications for its own cloud. Those cover Google's infrastructure, not Decrypted Tech.
- What we do today is everything on this page: ownership in your name, a U.S.-based team, U.S. data storage and the protections built into your software.
Reporting a security concern
Seen something that looks wrong? Tell a person.
Email us with “Security” in the subject line, or use the contact page. Include what you saw and where. A person on our team replies within one business day.
Questions
Security questions, answered plainly.
Something else on your mind? Send us a note and a real person will answer.
Who owns my data?
You do. It's stored in your own Google Cloud account, and the code is in your own GitHub account, both in your name from day one.
If we stop working together, do I keep everything?
Yes. The code, the data and the cloud accounts are already yours, your software keeps running, and there are no exit fees.
Who's actually doing the work? Is any of it sent overseas?
Our team is 100% U.S.-based. Everyone who designs, builds, supports or touches client data works in the United States, and we don't use offshore subcontractors.
Where is my data stored?
In U.S. data centers, in your own Google Cloud account. AI features send the text they need to an AI model provider, and emails go through an email delivery provider. Both are listed on this page.
Does the AI train on my data? Can my competitors see it?
The AI model providers we use don't train on business API data. Your records live in your own cloud project, separate from every other business we work with.
Who can get into my system?
The people you give accounts to, each with their own sign-in, seeing only what their role allows. Our team's access is tied to named accounts and removed when no longer needed.
Is my customers' information safe? What if we get hacked?
No one can honestly promise a system will never be attacked. What we can show you is what's built in: a sign-in for every user, role-based access, rules enforced on the server and checked by automated tests, an activity log, and private files that never go out by public link.
Are you SOC 2 certified?
No. We'd rather say so plainly than imply otherwise. This page lists what we do today. If a customer or insurer asks about your software's security, this page is a good place to start, and you can send their questions to us.
Bring your questions to a video call.
Tell us how your business runs and what you need to protect. We'll show you what you'd own and how it's secured, before you sign anything.