Security

Security is a first-class concern at DeskCrew. This page describes, in plain language, how we protect the support data that runs through the Service. We aim to be honest about what we do today rather than to over-claim certifications we do not yet hold.

Per-workspace data isolation

DeskCrew is multi-tenant: every record belongs to exactly one workspace (tenant), and access is scoped to that tenant throughout the stack. Queries are filtered by tenant, and the widget and public API are origin-locked to each tenant’s configured allowlist. One customer’s data is never exposed to another.

Encryption

• In transit: all traffic to the Service is served over HTTPS/TLS.
• At rest: the database is hosted on managed infrastructure with encryption at rest, and sensitive secrets (such as integration and identity-signing secrets) are encrypted before they are stored.

Signed inbound-email webhooks

Email-to-ticket and delivery events arrive as signed webhooks from our email provider. We verify the cryptographic signature on every inbound webhook before processing it, so forged or replayed requests are rejected.

You control what AI and agents can send

Each workspace decides which AI features may answer customers on their own and which only prepare drafts for a person to approve. Outside AI agents can only draft unless an admin grants a specific agent credential permission to send. Agent features are off until you turn them on, and when anything is unsure they stop rather than send. If your own AI agent answers your website chat, any reply that contains something shaped like a key or an internal address is blocked before a visitor sees it, and visitor messages that look like manipulation attempts reach your agent flagged. Our AI Policy lists exactly which features answer on their own.

Rate limiting & abuse protection

Public endpoints (the widget submit path, the agent door and the API) are rate-limited and input-validated to protect against abuse and runaway usage. Agent payments carry per-wallet caps and a reputation gate.

Authentication & access control

Operators authenticate to sign in to a workspace, and sensitive actions (rotating widget keys, managing allowed origins, revealing identity secrets) are gated to admin/operator roles and recorded in an audit trail. Every workspace has a protected owner: the person who created it cannot be removed, demoted or signed out by a teammate. Invites always join as Agents, and only the owner can make someone an admin.

Infrastructure

DeskCrew is hosted in Singapore on managed cloud infrastructure with encrypted storage. We rely on these providers’ platform-level security controls in addition to our own application safeguards. Our subprocessors are listed by role and region in our Data Processing Agreement; the named list is available to customers on request.

Security questions, answered

Do you hold a SOC 2 or ISO 27001 certificate?

Not yet. We would rather say so than imply it. We answer security questionnaires in writing and describe our actual controls on this page.

Who at DeskCrew can see my data?

Only DeskCrew operators who run and support the Service, and only when needed. Production administration sits behind an additional access gate, and admin actions are recorded in an audit log.

Do you train AI on my tickets?

No. Support content is used only to answer for your workspace. See our AI Policy.

Can one customer ever see another customer’s data?

No. Every record belongs to one workspace, every query is scoped to it, and our tests check that one workspace cannot read another’s tickets, reports or exports.

How do I sign in?

With an emailed sign-in code, or with a Google, Whop or Slack account. Sign-in links and codes expire quickly, and connections to other services are protected against forgery.

What happens if there is a breach?

We notify affected customers without undue delay and within 72 hours, as set out in our Data Processing Agreement.

Can I export or delete my data?

Yes. Reports export as JSON, CSV or Excel, tickets are available through the API, and we delete a workspace’s data on request or after the wind-down period when it closes.

How is money handled?

Card details are handled by our payment and card checkout providers and never reach DeskCrew. USDC credit for each workspace arrives at its own deposit address, and we are alerted immediately if funds ever move anywhere they should not.

Responsible disclosure

If you believe you have found a security vulnerability, please report it privately to security@deskcrew.io (or hello@deskcrew.io). Please give us a reasonable opportunity to investigate and remediate before any public disclosure, and do not access or modify data that is not yours while testing. We appreciate good-faith research and will work with you.

This page describes our current practices for transparency and is not a contractual warranty or a substitute for a formal security assessment. For security questions specific to your deployment, contact us.