Security
The data stays in your cluster.
Deckview is server-rendered, self-hosted and deliberately small. It reads the sources you already run, writes a copy to your Postgres, and sends nothing to a third-party analytics service.
What is collected
Accounts and sign-ups, web events and sessions, subscription snapshots, mail envelopes and SES delivery events, infrastructure metrics, and the facts you type into the CRM. The public beacon accepts events on a separate port; the dashboard cannot be reached from it.
What is not collected
- No session replay, screen recording or keystroke capture.
- No advertising identifiers, cross-site profiles or data sale.
- In structural mode, no page text: the tracker records the shape of the page, not what a customer typed into it.
Retention
Raw web events are kept for 180 days by default. The rollups outlive them and carry no visitor id, so after the window the aggregate remains and the individual trail does not. The window is configuration, not a promise.
Sign-in
The dashboard uses better-auth with an email allowlist and a session cookie. There is no public sign-up. The first account is created from a deployment secret; adding a second person is a deliberate change to the allowlist.
Reporting a problem
Write to [email protected]. Include the smallest reproduction you can and do not send customer data. The machine-readable contact is at /.well-known/security.txt.