Trust centre
Security, privacy and compliance at ChaosDesk
What protects your support data, where it lives, who helps us process it, and where our compliance programme stands.
Last updated
Overview
Data location
Workspaces, databases and backups are hosted in the EU (Hetzner, Germany; Backblaze, EU Central). Support data does not leave the EU except for the subprocessors listed with Standard Contractual Clauses, and AI only when you switch it on.
Workspace isolation
Every row carries its workspace, and the database enforces it with row-level security. Search indexes, files, caches and realtime channels are scoped the same way. Cross-workspace tests run on every change.
Encryption
TLS 1.2 or newer with HSTS for every connection to us. Disks and database backups are encrypted (AES-256). Integration secrets use a key that belongs to your workspace alone.
Secure development
Code review on every change; static analysis, dependency, secret and container scanning in CI; SSRF protection on every outbound call; sanitised rich text and help-centre themes.
Audit and access
Append-only ticket history, admin and access audit logs you can export or stream. Our staff reach production only through an access proxy with MFA and recorded sessions, and see your workspace only when you grant support access.
AI with privacy
Personal data is redacted before text goes to the AI provider, it is never used to train models, and admins can switch AI off completely.
In detail
Security measures
- Encryption in transit
- TLS 1.2+ (TLS 1.3 preferred) at the edge and to origin, HSTS (2 years, subdomains), WireGuard between cluster nodes, TLS to the database.
- Encryption at rest
- LUKS2 encrypted database and service volumes, AES-256 encrypted database backups, server-side encrypted file storage, encrypted Kubernetes secrets. Per-workspace envelope keys for credentials; deleting the key makes them unreadable, backups included.
- Authentication
- Passwords hashed with Argon2id, MFA (authenticator app, passkeys, security keys), SSO with SAML and OpenID Connect, SCIM provisioning, session and password policies, IP allowlists (Enterprise).
- Backups and recovery
- Continuous database archiving (point-in-time recovery), daily full backups in two providers, an off-site copy with object lock, regular restore drills.
- Monitoring
- Metrics, logs, alerts and an on-call rotation for availability and security signals; audit logs for admin and staff actions.
- Vulnerability management
- Dependency and container scanning on every change, patching windows by severity, an external penetration test before launch, and a responsible disclosure programme.
- Abuse prevention
- Sign-up screening, sending limits and reputation monitoring, look-alike workspace names blocked, report-abuse links on hosted pages, and a takedown process.
- People
- MFA and hardware keys for staff, managed and encrypted laptops, least-privilege access reviewed quarterly, confidentiality agreements, security training, same-day offboarding.
Compliance roadmap
Status, as it is today
Certifications take time. We list what is in place, what is in preparation and what is not planned yet.
| Topic | Status | Details |
|---|---|---|
| GDPR | In place | EU hosting, data processing agreement, tools to export and erase an end user's data, retention policies and redaction. |
| Data processing agreement | Draft, final before launch | Our standard DPA with the EU Standard Contractual Clauses where needed, breach notice within 48 hours. |
| Subprocessors | Published | The full list, with purpose and location. Changes are announced 30 days in advance. |
| External penetration test | Planned before launch | App, API, help centre, messenger and workspace isolation. A summary letter is available on request after the test. |
| SOC 2 Type I | In preparation | Policies drafted (access, incident response, encryption, vendor management, employee security). Audit window to be announced here. |
| SOC 2 Type II | Planned | Follows Type I after the observation period. |
| ISO 27001 | Not planned yet | We will reconsider when customers ask for it. |
| Accessibility (WCAG 2.1 AA) | In progress | Automated checks on every release, manual audit before launch, VPAT on request. |
Subprocessors
We use a small number of providers to run ChaosDesk, mostly in the EU. The subprocessor list names each one, what it does and where it processes data. Workspace owners get 30 days' notice of changes.
Status and availability
A public status page with live availability and incident history goes online at launch and will be linked here.
Incident response
We run a documented incident response process with severity levels, an on-call lead and a post-incident review for every serious incident. If a security incident affects personal data in your workspace, we tell you without undue delay and within 48 hours of becoming aware of it, with the facts you need for your own 72-hour GDPR notice, and keep you updated until it is closed.
Report a vulnerability
Email [email protected]. We acknowledge within 3 business days and do not take legal action against good-faith research. Rules and scope: responsible disclosure, machine-readable contact: security.txt.
Report abuse
Phishing, spam or harmful content on a help centre, community or messenger hosted by ChaosDesk, or email sent through us: use the "Report abuse" link at the bottom of that page or email [email protected] with the URL or the full email headers. We review phishing and malware reports within 24 hours and take down confirmed cases.
Security reviews
We answer security questionnaires (CAIQ, SIG Lite or your own) and can share our policies, the penetration test summary and the VPAT under NDA. Write to [email protected] or [email protected].