Secure by default. Honest about the rest.
2FA, GDPR data export and deletion, audit log, role-based access, EU-region application data, and custom-domain SSL, all built in. What we have today, and what we don't yet.
Only the right people, only the right data.
Role-based access, department-scoped permissions, and TOTP 2FA. Locked-down by default, granular when you need it.
Roles & permissions
Department-scoped| Permission | Owner | Admin | Agent |
|---|---|---|---|
| Reply to tickets | |||
| Apply macros | |||
| Manage knowledge base | |||
| View reports | |||
| Manage team | |||
| Billing |
TOTP two-factor auth
Every team member can enrol an authenticator app for time-based one-time codes, with recovery codes as a fallback.
Role-based access
Owner / Admin / Agent. Department-scoped, agents see only the products they support.
Session security
HTTP-only cookies, rotating session tokens, automatic session invalidation after password reset.
API tokens
Each token belongs to one person and one workspace, is read-only or read-write, can expire and be limited to IP addresses, and can be revoked at any time. API changes are recorded in the audit log.
Security overview
8 / 8 agents
TOTP via authenticator app
Self-serve export
Customer deletion within 30 days
Every action
Logins, roles, exports, API
Audit log · recent
- [email protected] , logged in via 2FA2 min ago
- [email protected] , invited new agent ([email protected])14 min ago
- system , rotated API token (last 4: 9c41)38 min ago
- [email protected] , exported customer data for cus_91xa1 hr ago
Your data stays yours.
Full export, customer deletion, sensitive data masked before it reaches the AI, and an audit log of every privileged action. You own it; we record it.
GDPR data export
Full workspace data export at any time, tickets, customers, notes, attachments, automations.
Audit log
Every privileged action recorded, logins, role changes, exports, deletions, API events.
Customer deletion
Customer-data deletion requests honored within 30 days. Hard delete cascades through tickets, notes, attachments, and audit entries.
EU-region storage
Application data sits in EU-region Postgres, with daily backups. Every sub-processor is listed in our Privacy Policy.
See the sub-processor listMasked before AI
Sensitive financial data and secrets are masked before reaching the AI.
The boring stuff, done right.
TLS everywhere
The app, the help portal, the widget and the API are served over HTTPS with TLS 1.2 or later.
Custom-domain SSL
Automatic SSL via Cloudflare for customer-portal custom domains. Auto-renew. No manual cert management.
Sender identity verification
SPF, DKIM, and DMARC are first-class for custom sender identities. We refuse to send from unverified domains.
Permission-checked attachments
Attachments are never public. They are served only through authenticated, permission-checked links.
Honest, current, on the record.
We list what we have today and what is on the roadmap. We won't claim certifications we don't hold.
GDPR ready
Export + deletion + DPA available on request
EU data residency
Application database in EU-region Postgres
Audit log
Every privileged action recorded
Two-factor auth
TOTP via authenticator app for every member
SOC 2
In progress, contact us for our roadmap
HIPAA
Not in scope, talk to us if you need it
Uptime and incidents are public on our status page. Sub-processors are listed in our Privacy Policy.
Need a DPA or a completed security questionnaire? [email protected]