Security

What Flatdesk doesn't have yet

Read this first, so nothing below reads as more than it is.

• SOC 2 or ISO 27001 report. Flatdesk is new and hasn't been audited.
• An independent penetration test.
• An uptime commitment with service credits.
• A choice of data region.
• HIPAA or PCI scope. Don't send health records through Flatdesk. Card numbers customers paste in anyway are masked when they arrive (see below), but Flatdesk isn't PCI assessed.

If one of these is a requirement for you, Flatdesk isn't the right fit today. Tell us which, at hello@flatdesk.app, because it decides what we build next.

Controls your admins have

• Required two-step verification. An admin can require it for the whole team. Anyone without an authenticator app on their account is stopped before the help desk opens until they add one.
• Single sign-on. OIDC or SAML, so your team signs in through Okta, Google Workspace, Azure AD or another provider. An admin proves the email domain with a DNS record, tests the connection with a sign-in of their own, and can then require it for everyone on the verified domains. Sign-in always starts from Flatdesk, SAML assertions must be signed, and the provider can only vouch for addresses on domains you have verified. New people can be added automatically on first sign-in, or only invited. Passwords for those addresses stop working while it is required, so keep one admin on another domain in case your provider is down. SCIM 2.0 provisioning lets Okta or Entra ID add people and remove them when they are unassigned or deactivated, using a token an admin can revoke; it only adds addresses on verified domains and never removes an admin. Setup guide.
• An off switch for AI. With “Allow AI features” off, nothing from your team is sent to the AI provider: no AI answers, drafts, summaries, AI macros or test drive. Every call to the AI goes through one check, so no feature can skip it. You can try Flatdesk this way and turn AI on later, or never.
• Card numbers masked on arrival. Customers paste card numbers into emails and chats whatever you tell them. Any number that looks like a card (13 to 19 digits that pass the card checksum) is replaced with “[card number removed, ending 4242]” before the message is saved, so it never reaches your team or the AI, and the message exports (CSV and JSON) carry the masked text. This covers emails, chats, replies and imported tickets. Two places keep what was sent: attachments are stored and exported as the original files, and the original-record archive of an import holds what your old help desk returned. Neither is scanned. A number split across lines isn't caught either.
• Verified chat for signed-in users. Your server signs the user's email with your team's chat secret, so a ticket from your app says who was signed in and whether the signature checked out. A visitor can't claim to be one of your customers by typing their email.
• An audit log. Settings changes, seat changes, exports, imports, AI answer refunds, deleted macros and people joining, with who and when. Admins see it in Settings, and it's in the full export.
• Roles. Admins change settings and billing. Agents answer tickets. Viewers can read but not change anything, and aren't billed. Removing someone from the team in Flatdesk ends their access.
• A full export, any time. One download has every ticket, message, customer, macro, help article, the audit log, and every attachment as its original file. Admins don't need to ask us.
• Customer data requests. When a customer asks for their data or to be forgotten, an admin downloads it as a file or erases them, with every ticket, message and file, from any of their tickets. Both are in the audit log.

How data is handled

• Data is encrypted in transit (HTTPS only) and at rest by our hosting and database providers.
• Every team's data is kept apart in the database by team, and every page and action checks the signed-in person's team before reading anything. Automated tests check that one team can't reach another team's tickets, files or settings.
• Attachments can be downloaded only by your team, and by the chat visitor they were sent to.
• API tokens for importing from your old help desk are encrypted while the import runs and erased when it ends.
• Sign-in is handled by Clerk. Flatdesk never sees or stores passwords.
• Card details go to Stripe and never reach Flatdesk.
• The chat widget, ratings and sign-up forms are rate limited, and store a one-way hash of the sender's IP address rather than the address.

The AI

AI features use Anthropic's API. Under Anthropic's commercial terms, data sent through the API isn't used to train its models. Flatdesk doesn't use your conversations to train anything either. What's sent: the ticket being answered, your team's AI notes, macros and help articles. AI answers to customers are on for new teams, but nothing reaches a customer until you forward your support email or add the chat widget, and an admin can switch AI answers, or all AI processing, off first.

Who processes your data

Vercel (hosting), Neon (database and files), Clerk (sign-in), Stripe (payments), Resend (email) and Anthropic (AI). Each one's role and privacy policy is listed in the privacy policy. We give 30 days' notice before adding a new one (see the DPA).

Answers to common vendor questions

• Backups. Tickets, settings and attachments live in a Neon Postgres database, which keeps a restore history so it can be rolled back to a point in time inside that window. We haven't yet run and written up a timed restore drill, so there's no tested recovery time, and no committed RPO or RTO, to quote.
• Status. The status page checks the database, email and AI live when you open it. It keeps no history and there is no uptime commitment yet.
• Who can reach production data. Only Flatdesk's operator, through the hosting, database and email providers' own consoles. There's no support staff or contractor with access. We look at a team's tickets only when that team asks us to, for support.
• Changes. Every code change goes through a pull request and a preview deployment before it reaches production, and the test suite (including the checks that teams can't see each other's data) is run before it's merged.
• Logs. Your admins see the audit log in Settings. Request logs are kept by the hosting provider. Message text isn't written to logs on purpose.
• Your questionnaire. Send it to hello@flatdesk.app and we'll fill it in. Where the answer is no, it says no.

Trying Flatdesk without handing over your data

You don't need to import anything real to see whether Flatdesk works for you.

1. Read this page and the DPA, and send us your questionnaire first if you have one.
2. Sign up and turn off “Allow AI features” in Settings, Security, before anything else (the import form has the same switch). With it off, nothing goes to the AI provider.
3. Use Test tickets: an admin plays the customer by email or chat and watches how triggers, targets, macros and (if you turn it on) the AI handle it. Test tickets stay out of reports and billing and clear in one click.
4. When you're ready, import. Card numbers in old tickets are masked as they arrive. If you decide against Flatdesk, deleting the account removes your data within 30 days.

If something goes wrong

If we learn of a breach affecting your data, we'll tell your team's admins without undue delay and within 72 hours, with what we know and what we're doing about it. Deleting your account removes your data within 30 days.

Report a vulnerability

Email hello@flatdesk.app with the details. We'll reply within two business days and won't take legal action against good-faith research that avoids other teams' data and doesn't disrupt the service.