StartupDeckAI

Most people use StartupDeckAI at startupdeck.in — sign up, validate an idea, and export reports from the dashboard. No installation required. Use Help Center for account and billing questions. The sections below cover product features and how the service is run. StartupDeckAI is online only; there is no self-hosted version.

Tech Stack

Project Structure

client/
├── src/
│   ├── components/     # Reusable UI components
│   ├── pages/          # Page components
│   ├── hooks/          # Custom React hooks
│   ├── lib/            # Utility functions
│   └── services/       # API service layer
├── index.html
└── vite.config.ts

Service architecture

The backend is a Node.js API with route handlers, background jobs, and service modules. Internal file layout is not documented here — refer to your authorized codebase copy.

Data is stored in PostgreSQL using an ORM-managed schema. After configuring your database connection locally, apply migrations with the project scripts — do not expose schema details publicly.

Database commands

# Push schema to database
npm run db:push
# Create admin user
npm run create-admin

Post-Deployment Checklist

Configuration

Deploy Steps

# Install Vercel CLI
npm install -g vercel
# Deploy
vercel --prod

Configuration

Environment variables

Configure production secrets in your hosting provider's secret manager. Use values from your private .env.example — do not paste live credentials into docs, tickets, or chat.

Create an admin user

[email protected] ADMIN_PASSWORD=<strong-secret> npm run create-admin

After creation, sign in, enable two-factor authentication if available, and rotate credentials on any non-production environment before go-live.

Dashboard Tabs

Roles

Founder OS gets its numbers from the tools you already use. You connect your own account, either by approving StartupDeckAI in the tool's own screen or with a key you create, and StartupDeckAI only reads from it. It never creates, changes or deletes anything in a connected account.

How to connect a tool

1. Open Integrations in Founder OS and choose a tool. The Popular and New filters show where to start.
2. Read the short list of what we read from that tool.
3. For Stripe, GitHub, Slack, HubSpot and Notion, press Continue with the tool. The tool's own screen asks you to allow the read permissions the dialog lists, and nothing else. No key changes hands.
4. For every tool, you can instead follow the steps in the dialog to create a key, limit it to read access where the tool allows it, and paste it. We check the key with the tool first.
5. Either way, what the tool gives us is stored encrypted and the first import starts.

How it stays read only

• Every request to a connected tool passes through one check that refuses anything other than a read. A few tools use a POST for searching, checking a key or swapping an approval code for a token. Those are listed one by one, and none of them changes anything in your account.
• When you approve StartupDeckAI in a tool, we ask only for read permissions. Where the tool reports what it granted (Stripe, GitHub, Slack and HubSpot do), we check the grant and refuse to connect if it can do more than read. Notion does not report this, and the dialog says so.
• Where a tool lets you limit a key to read access, the dialog asks you to do that, so even a mistake on our side could not write. Where a tool cannot, the dialog says so plainly.
• Requests identify themselves as StartupDeckAI, wait when a tool asks us to slow down, and stop after a few tries.
• Keys and access tokens are encrypted before they are stored and are never shown again. Tokens that expire are renewed before use and stored the same way.

What stays under your control

• You choose which repositories, pages, projects or channels a connection can reach, wherever the tool lets you.
• Revoke the key, or remove StartupDeckAI, in the tool at any time to cut access straight away.
• Disconnecting in Founder OS deletes the key or token and the records we imported from that tool. For a tool you approved, we also ask the tool to end our access, and tell you if it did not confirm.

What each tool reads

StartupDeckAI checks a startup idea before you build it. Pro Plus and Enterprise plans add Founder OS, which helps run the company once it has customers.

Overview

StartupDeckAI supports two-factor authentication (2FA) for all user accounts. When enabled, logging in via username/password or Google OAuth requires you to verify your identity with a dynamic, single-use 6-digit passcode. This prevents unauthorized access even if your password or OAuth credentials become compromised.

Supported Authentication Methods

How to Enable 2FA

1. Log into your account and navigate to Account Settings.
2. Scroll down to the Security & Two-Factor Authentication section.
3. Select your preferred method: Authenticator App or Email OTP.
4. For Authenticator Apps, scan the generated QR code or copy the plaintext secret key. For Email OTP, verify the test code sent to your inbox.
5. Enter the 6-digit confirmation token to securely activate 2FA.
6. Copy and store your Emergency Recovery Codes in a safe place. If you ever lose access to your device, these codes are the only way to regain access without administrator intervention.

Login Verification Flow

Once activated, the authentication sequence intercepts access post-credentials check:

Admin Exemption & Panel Security

For administrative accounts, standard user-level 2FA is deactivated. Instead, administrators must verify their identity using a specialized **Secret Key Verification Challenge Overlay**. This timing-safe, cryptographically hashed challenge must be verified before the system grants access to the high-privilege Admin Panel, ensuring maximum defense for user data and infrastructure control.

Rate-limited responses return 429 Too Many Requests with a Retry-After header.

Nginx Configuration

server {
    listen 443 ssl http2;
    server_name your-domain.com;
    ssl_certificate /path/to/cert.pem;
    ssl_certificate_key /path/to/key.pem;
    location / {
        proxy_pass http://localhost:5000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Error Tracking with Sentry

npm install @sentry/node @sentry/profiling-node

Key Metrics to Track

• System Health: Database, Redis, and email service status
• User Analytics: Growth tracking and user behavior
• Revenue Analytics: MRR, ARR, and financial projections
• Performance: CPU, memory, and response times

Database Optimization

-- Add indexes for performance
CREATE INDEX CONCURRENTLY idx_analyses_user_id_created_at
  ON analyses(user_id, created_at);
CREATE INDEX CONCURRENTLY idx_competitors_analysis_id
  ON competitors(analysis_id);
CREATE INDEX CONCURRENTLY idx_usage_tracking_user_id_feature
  ON usage_tracking(user_id, feature);

Load Balancing

upstream startupdeck_backend {
    server 127.0.0.1:5000;
    server 127.0.0.1:5001;
    server 127.0.0.1:5002;
}
server {
    location / {
        proxy_pass http://startupdeck_backend;
    }
}

Redis Connection Failed

# Check Redis status
sudo systemctl status redis-server
# Restart Redis
sudo systemctl restart redis-server

Database connection issues

Verify your database is running and that connection settings in your private environment file match your deployment. Test from your secure shell — do not share connection strings publicly.

Payment Webhook Failures

# Test webhook endpoint
stripe events resend evt_webhook_id
# Check webhook logs
stripe logs tail