Security and data for organizations

• Boards, cards, comments and attachments go directly between the apps and your Nextcloud server, never through a Deckloud relay.
• The apps allow unencrypted http:// for a server on a private network. Use HTTPS for encrypted transport.
• Each app checks its license with api.deckloud.com, as listed below.
• api.deckloud.com contacts your server only during admin verification.

Apps check a server without a license at most once a day. For a licensed server, the desktop app checks every 6 hours while it runs; the iPhone, iPad and Android apps check the active account on opening, once the last check is 12 hours old. Users can also select Check again.

The apps send no user names, email addresses, Nextcloud user IDs or group memberships. They read the user's ID and groups from your server (/ocs/v2.php/cloud/user) with the existing login and check the group on the device. Deckloud knows only the licensed group's ID. To suggest a team license, the app counts on the device how many people share the user's boards, and never sends that count. A Send to IT link you send contains the suggested number of seats, which deckloud.com receives when someone opens it.

Admins who manage the license also send what they enter: the license key, server addresses, the group ID and the analytics policy.

• The license: plan, status, seats, paid period, organization name (from Polar, or entered for a trial before 8 November 2026) and the Polar customer, subscription and order IDs. Also a SHA-256 hash of the license key, the email address the key was sent to, the chosen group ID and the analytics policy.
• For trials started before 8 November 2026: the contact email an admin entered and a log of the trial emails sent. Deckloud no longer sends these emails; to have an address deleted, email partners@deckloud.com.
• Bound servers: each server address and when it was bound. For trials started before 8 November 2026, also the server address of each trial.
• Seats: each seat hash with when it was first and last seen; the last-seen time is updated at most once per UTC day. A seat is deleted 60 days after its last use. Anyone who can reach api.deckloud.com could report a seat hash, so the seat count is information only and never limits Pro or billing.
• For provider licenses: the daily peak of bound servers, for billing.
• For rate limits: SHA-256 hashes of the requesting IP address and other limited values such as the license key, deleted within 2 days.

To manage a license without the key, or to buy one that binds the server, an admin verifies the server:

1. api.deckloud.com starts Nextcloud Login Flow v2 on the server address the admin entered.
2. The admin signs in on the server's own login page and grants access. Nextcloud gives api.deckloud.com a temporary app password.
3. api.deckloud.com uses it once to read /ocs/v2.php/cloud/user and checks that the account is in the admin group.
4. It asks Nextcloud to delete the app password, and creates an admin session only once Nextcloud confirms the deletion.

Until then, api.deckloud.com keeps the app password encrypted, for this check and its deletion only; if it cannot store it, it skips the check and requests deletion at once. A failed deletion is retried for up to 30 days; the copy is erased on confirmation or after those 30 days. Encrypted database backups (7 daily, 4 weekly and 6 monthly copies) can hold the copy and its key until they expire. The admin can also revoke the app password in Nextcloud Settings > Security.

api.deckloud.com connects only to public addresses over HTTPS. A verification lasts 1 hour and covers only the verified server address. Adding servers or opening the Polar customer portal needs the license key.

• A license key has 125 bits of randomness. Deckloud emails it to the purchase email address and stores only its hash; the website never shows it.
• Tokens are signed with Ed25519. The apps verify the signature on the device with Deckloud's built-in public keys.
• A device accepts a token only if: the signature is valid; the token has not expired; the account's server address is in origins; the device platform is in platforms; and, if grp names a group, the user is a member.
• The organization license never removes or replaces a personal Pro purchase.
• Organization Pro applies only while the account on the licensed server is active in the app, never to personal accounts on the same device.

{
  "lid": "lic_01J8Z…",
  "plan": "business",
  "org": "Example GmbH",
  "origins": ["https://cloud.example.com"],
  "seats": 50,
  "platforms": ["ios", "android", "macos", "windows", "linux"],
  "policy": { "analytics": "default" },
  "grp": "deckloud-users",
  "iat": 1790000000,
  "exp": 1792592000
}

A token is valid for at most 30 days from issue. It ends with the paid period of a canceled subscription; a renewing one gets up to 7 more days to cover a late payment. Until then, Pro works offline and while api.deckloud.com is down. After a refund or revocation, apps return to Free at their next license check or when the token expires. Returning to Free deletes nothing.

For networks without internet access, Deckloud issues signed offline licenses under a separate agreement, delivered through managed configuration. Apps verify them on the device only, without contacting api.deckloud.com or counting seats, until the agreed end date.

Users sign in with Nextcloud Login Flow v2 on your server's own login page, so your single sign-on and two-factor authentication apply unchanged. The app gets a device app password that the user or an admin can revoke in Nextcloud. There is no Deckloud account.

• Credentials: Keychain on iPhone, iPad and Mac; Android Keystore on Android; Credential Manager on Windows; Secret Service on Linux.
• Workspace data: a local SQLite database for offline use, removed when the user signs out.
• License: the verified license record, stored per account and deleted with it.

The apps send pseudonymous product analytics and error diagnostics to PostHog with a random installation ID, without board content, credentials, server URLs or email addresses. They include:

• Two yes-or-no flags: whether the account is in the Nextcloud admin group, and whether MDM manages the device.
• Error diagnostics: the code locations of an error and, in the mobile apps, native crash reports.
• Performance measurements of launch, sync, opening a board and search, sent about every five minutes per kind; each holds the number of measurements, counts per duration range, total and longest duration, and the length of that period. No board or card content or identifiers.

Users can turn analytics off in the app. You can turn it off for every licensed user with the analytics policy, or on managed devices with the MDM key analytics; the app setting is then locked.

• Analytics policy in the admin guide
• MDM keys

The apps send only the data listed above. Deckloud processes technical connection data, such as the IP addresses of devices, to operate and secure the license service. If your data protection assessment concludes that a data processing agreement is needed, contact partners@deckloud.com.

When analytics are on, Deckloud is a separate controller for the pseudonymous device analytics described above. Deckloud Cloud, the optional hosted workspace, is a separate service and not part of the organization license.

The app security page describes the apps' data handling in full. Questions from security reviews go to partners@deckloud.com.