Trust & Security

Overview

Boridesk exists to let one team run support for many separate client companies, which means the platform's core job is keeping each client's data walled off, both from other clients and from other agencies entirely. Here's what's actually built and verified today.

Tenant isolation

Every agency is a tenant, and every ticket, message, and client record is scoped to that tenant at the database query level, not just in application logic. This is covered by an automated integration test suite that specifically tries to make one tenant see another's data, and confirms it can't.

Access control

Within an agency, admins control what each agent can see: agents can be scoped to specific client companies, or granted access to all of them. New agents see nothing by default until access is explicitly granted. Roles (Agent / Admin / SuperAdmin) gate administrative actions like inviting agents or changing settings.

Encryption in transit

All traffic to boridesk.com and the Boridesk app runs over HTTPS.

Webhook security

Inbound email is delivered to Boridesk over a signed webhook, verified with HMAC-SHA256. Unsigned or incorrectly-signed requests are rejected before they touch any tenant's data.

Account security

Changing your password immediately invalidates every other active session, not just on next expiry. Repeated failed login attempts trigger account lockout, and login endpoints are rate-limited.

GDPR & data handling

Wherever your agency and your clients are based, your agency is the data controller for the customer data flowing through your tickets, and Boridesk acts as your processor. This applies under UK/EU GDPR, US state privacy laws like CCPA, and equivalent rules elsewhere. We will sign a data processing agreement before you onboard your first client. Email [email protected] and we'll send it.

We use a small number of infrastructure providers to run Boridesk: application and database hosting, DNS and inbound email routing with private storage for ticket attachments, and outbound email delivery. Application data is hosted in the United States; transfers are covered by the standard contractual clauses in the DPA. The specific providers are named in the DPA we send on request, and we'll give you notice before adding or changing one.

You can delete a customer's data on request, and you can export your agency's tickets, messages and client records at any time. If you need a deletion or access request actioned on our side rather than yours, email us and we'll handle it.

Certifications & SLAs

SOC 2 and ISO 27001 certification are on our roadmap and will be pursued as we take on larger enterprise clients. A formal uptime SLA and backup-frequency guarantee are also planned for a later stage. Contact us directly if either is a current requirement for your agency.

Report a security issue

Found a vulnerability? Email [email protected] with details. We'll respond, and won't take legal action against good-faith reports.