Keeping data safe
Support systems hold the awkward data: order numbers, addresses, card complaints, people's problems. This page lists what is built to protect it, and says plainly where something needs a part we do not run yet. We hold no security certificate, and we do not pretend to.
Who can see and do what
There are 470 separate permissions. You group them into roles and give the roles your own names, so a role matches a real job rather than a tier on a price list.
- 470 permissionsChosen from a searchable list, with a side-by-side compare against another role
- Start a role by copying anotherThen change the few things that differ. Delete a role once its people are moved.
- Which tickets a role seesAll of them, only their own groups', or none
- Access level per groupNone, view, work on tickets, or manage
- Rules that limit a person to their own recordsEverything, their groups' records, only what is assigned to them, or nothing — set per area across tickets, customers, companies, help articles and reports, in the order you choose
- Enforced in more than one placeThe same rules apply in tickets, reports, team planning and search, not only on the list screen
- A preview of what one person can seePick a person, and the screen shows exactly what the current rules let them reach. You check it before you trust it.
- Cheaper roles that cannot be widenedA light role cannot be given permission to edit tickets, even by mistake
- Invite your team by list or fileA typed email list or a CSV, each with a role and groups. Resend or cancel an invitation.
- Temporary accessA seat for 1 to 30 days that ends by itself
- Limit who you can inviteOnly chosen email domains
- Decide which customers may write inAnyone, only listed domains, or everyone except blocked domains, with an optional code to their email first
- Copy one person's settings to anotherSo a new starter is set up the same as the person beside them
- Hand over the accountTransferring ownership asks you to type the company name
Signing in
- Two-step sign-inAn authenticator app on the phone, then a six-digit code at sign-in
- Choose who must use itNobody, admins only, all team members, or team members and customers
- Recovery codesGenerate a fresh set with your password typed again. You are warned when two or fewer are left.
- Admins can reset someone's two-stepFor the person who changed phone and lost the app
- Remember a deviceFor up to 30 days, and allow up to 30 days to postpone setting it up
- A score out of 100With how many people have no two-step sign-in and a what-to-fix-next list
- Password rules you setLeast length, how often to change, how many old ones are remembered, which character types are needed, a block on the 10,000 most common passwords, and a block on passwords built out of the email address
- Lock-out after wrong attemptsHow many tries, and for how many minutes
- Turn passwords off entirelyFor everyone except the owner, behind a typed confirmation
- See your own signed-in devicesBrowser, address and last seen, and sign any of them out
- Admins see every sessionEnd one, or sign a person out of every device at once
- Session limitsAn idle timeout, a longest session, how many sessions at once per person, and a warning before sign-out
- Trusted devices onlyList the team's devices, block one, or require a trusted device to sign in
- Only from your own networkA list of address ranges that may sign in. It is checked at sign-in, not on every later request.
- Block images in incoming emailSo a tracking pixel does not load on your team's screen
Two-step sign-in means an authenticator app, and nothing else. Recovery codes work too. There are no passkeys, no security keys, no codes by text message and no codes by email. If your security policy names any of those, this does not meet it yet.
Signing in with your company account
If your staff already sign in to a company account, they can use the same one here, and joiners and leavers can be handled by your directory instead of by hand.
- SAML 2.0Entity id, sign-on address and signing certificate, plus the email domains it covers, a default role, and whether to create a person on first sign-in
- OpenID ConnectIssuer, client id and secret
- Google and Microsoft Entra IDAdded the same way, as sign-in options
- Test the connection before you rely on itThen require company sign-in for everyone, with the owner still able to use a password as a way back in
- Details for your identity teamDownload the service-provider details to paste into your provider's set-up
- Map groups to rolesAnd map your provider's attributes onto fields on the person's record
- Customers tooLet customers use company sign-in on the help page
- Create and remove people automatically over SCIM 2.0Your provider creates, updates and deactivates people using a token you issue, with a log of recent calls you can read
- SCIM groupsWith a group-to-role map. Patch and filter work; bulk, sort, change-password and etag do not, and the screen says so.
- Tokens shown onceCreate and revoke SCIM tokens; the value appears one time
Company sign-in needs Keycloak, and this demo does not run it. All the screens above save their settings, and the settings are real records handed to Keycloak when it is there. Without it, the adapter does nothing: a connection saves, a test runs against nothing, and no real person is signed in by it. So treat company sign-in, directory sync and social sign-in as things to switch on when we set up your own install — not as something you can try on the demo today.
The same honesty applies to the LDAP and Active Directory screen. The driver that ships by default reads a local file and never touches the network. Real directory sign-in goes through Keycloak.
A record of who did what, that cannot be quietly changed
Most systems keep a list of events. This one chains them: each event stores a fingerprint of the one before it, so removing or editing an entry breaks the chain and the check tells you where.
- Search the recordBy text, category, who did it, what they did, the result and the date. Open an event to see the before and after values.
- Who looked at whatA separate log of who viewed, exported, downloaded or printed records
- A tamper checkIt reports the first break in the chain, and runs by itself every night
- SealsSeal the record now, or every hour, or every day. Each seal signs the latest point in the chain.
- An export you can proveA downloadable file plus a signature file that shows the export matches the record
- Export to CSVFor any date range, with a download link
- Lock itLock the record so only our support can unlock it, and only with a written legal reason
- How long to keep itSet the number of days to keep, and after how many days to archive
Where this stops. The chain, the checks and the seals are real and work with a signing key held on the server. Properly write-once copies of a seal need storage that physically refuses changes, which this hosting does not have, so the write-once setting is there but has nothing to write to. Signing with a cloud key service is also off here. If an auditor needs write-once storage, that is a hosting change, and we would scope it with you rather than claim it now.
When a customer asks for their data, or asks you to delete it
Under India's DPDP Act, the GDPR and the CCPA, a person can ask what you hold and ask you to delete it. This tracks the request to its due date and gives you something to show afterwards.
- Log the requestTo export, erase or correct, under DPDP, GDPR or CCPA, with a due date and a flag when it goes past it
- Check who is askingA six-digit code to their email, or a reason you write down and keep
- Run the exportAnd download the result for the person
- Run the erase, and get a certificateYou type their email to confirm. The certificate holds a fingerprint of the subject, so you can prove later which record was erased.
- Legal holds stop an erasePlace a hold on one person, a company, a ticket or the whole workspace, and nothing under it can be deleted
- Reject a requestWith a reason that goes back to the person
- How long you keep each kind of dataPer data type: keep for so many days, then anonymise, delete or archive
- Rules run as a practice firstPreview what a rule would remove, run them all now, and a nightly sweep does it from then on
- Label your fieldsPublic, internal, confidential or restricted. Card numbers, Aadhaar and PAN are locked to restricted and cannot be loosened.
- Rules per departmentA data class per department, with bulk export blocked, the roles allowed, and its own retention days
Two limits worth knowing. There is no form a customer can fill in themselves — somebody on your team logs each request, so build that into your published privacy process. And the export covers the parts of the product that have registered themselves with the privacy service, which today is the privacy records and the files. Check the output against what you hold before you send it to anyone.
Hiding a value, and recording who looked
Your team usually needs to know a customer, not their card number. A hidden field can be revealed, but only by someone with permission, and only after they say why.
- Hide a field's valueIn three styles of masking, from people without the permission
- A reason is required to reveal itAnd the reason is logged against the person who asked
- The same on customer recordsHide chosen customer fields, and reveal one on request with a stated reason
- Choose what is maskedWhich customer and company fields are masked, hidden or encrypted
- See what is coveredA list of every masked or encrypted field, with a sample of how the mask will look
- Blank out numbers in textCard numbers, checked properly before they are redacted, plus Aadhaar and PAN and up to 20 patterns of your own, with a box to try a pattern on real-looking text
- Applied where text travelsIn what goes to an AI service, in messaging, in help-article search terms and in automatic rules
- Phone numbers hidden from light rolesIn the call list
- Encrypt a field's stored valuesNote the trade: an encrypted field cannot be searched or reported on, and for values already saved it cannot be undone
- Rules for the chatbotBlock it from repeating a card, Aadhaar or PAN number, and name the topics it must hand to a person
- Recording consent on callsAsk at the start of a call, and show your team the wording to use
Attachments
An attachment is how most unpleasant things arrive. These checks run before anyone on your team can open one.
- 24 file types blocked everywhereIncluding the double-extension trick. No admin can override this list.
- A file that lies about what it is, is refusedThe contents are checked against the name, which catches a program dressed as a document
- Your own list on topAllowed types, the number of files per message, and the largest file size
- Password-protected zips blockedBecause nothing can look inside them
- Photo location data strippedFrom JPEGs, so a customer's home address does not travel with their photo
- Files private by defaultReached by a signed link, not by a guessable address
- Delete files after a set number of daysAutomatically
- QuarantineA flagged file is held in a list. Releasing or deleting it needs a typed confirmation.
Virus scanning needs a scanner we do not run on the demo. The scanning step is built and the quarantine works, but the scanner behind it on our demo is a stub that only recognises the standard antivirus test file. Real scanning means ClamAV running alongside your install. The blocked-type list, the contents check, the zip block and the location stripping are all real and work without it.
Where your data sits, and who holds the keys
- Four regionsIndia, Europe, the USA and Australia, with the screen showing which one your account is in
- Ask to move regionWith a reason, behind a typed confirmation. It needs our approval, a scheduled time, a run and a window to roll it back.
- Keep text inside the regionStop sending data to AI services outside it
- Block sign-ups from sanctioned countriesA switch, with the check applied at sign-up
- Which key is in useIts versions and a history, with AES-256-GCM encryption of your data keys under a key held on the server
- Rotating a key takes two peopleOne admin asks, a different admin approves, and the data is re-wrapped in the background
- A reminder to rotateEvery so many days, as you set it
- Bring your own keyNamed by reference, with a test, approval by two admins, and a way back to our key
Bring-your-own-key is not ready, and a region move does not really move anything yet. Bringing your own key needs a cloud key service that is not switched on here and whose client is not even installed, so only a local key file works for a trial. The region move runs its approvals and its checks, but on this deployment it compares table totals on one database and copies nothing; a real move needs a database cluster in the other region. There is also a health-data mode for France, which is a setting on the account and not a hosting certification.
Letting outsiders in, on a timer
Nobody should have standing access to your support system, including us.
- Temporary access for a supplierUp to 168 hours, with a role and a reason, ending by itself
- Our support only when you say soYou allow us in for a chosen number of days, decide whether we may change anything, stop it whenever you like, and read the history of every past grant
- Refused without a grantOn our side a support session will not open at all without an active grant, is read-only unless you allowed changes, needs a written reason, and is capped at four hours
- Fixed outgoing addressesAsk for static outbound addresses to put in your own firewall list
- A security overviewThe score, open privacy requests, where your data is held, recent security events, and our published security notes
- Tell us about a weaknessSet where a vulnerability should be reported, with links to the accessibility and uptime statements
- Keep personal data out of alertsA setting that keeps security notifications free of customer details
About certificates
We hold no outside security certificate, and we will not imply that we do. None for information security, none for health data, none for card data. The compliance screen inside the product says exactly that. If your buying process needs a named certificate before you can sign, we are not the right fit today, and we would rather you knew that on this page than three weeks into a procurement review.
What is built instead is the work underneath one: a tracker where you record each control with its status, a link to the proof and a next review date; a request for a pack of that evidence together with the seal on the audit log, the retention settings, the access settings and the role list; and a way to ask us by email for our own security review documents. Judge this page on what is built.