How ServAIceDesk protects your data

Tenant isolation

• Every table that holds customer data carries database row-level security. The application connects as a non-privileged database role, so one organization's request can only ever read or change that organization's rows.
• An automated isolation test suite runs against that same restricted role before every release.
• Each organization has its own service desk address, and files are stored per organization.

Sign-in and accounts

• Email and password sign-in. Passwords are stored only as salted scrypt hashes, must be at least 12 characters, and are checked against public lists of leaked passwords without the password ever leaving our servers.
• Optional two-step verification with any standard authenticator app, plus single-use recovery codes. Admins can require it for every admin and agent, and can reset it for someone who lost their phone.
• Repeated wrong passwords pause the account for 15 minutes, and sign-in errors never reveal whether an address has an account.
• People are emailed whenever their password or two-step verification changes. Changing or resetting a password signs out every other device.
• Sessions use HttpOnly, Secure cookies. The ServAIceDesk operator console always requires two-step verification.

Encryption

• All traffic uses HTTPS, with HTTP Strict Transport Security on every ServAIceDesk address.
• Integration credentials (connector passwords, API tokens) are encrypted by the application with AES-256-GCM before they are stored, and are never shown again after saving.
• Payments are handled by Stripe; ServAIceDesk never sees or stores card numbers.

Where your data lives

• The service, its database and uploaded files run on servers ServAIceDesk rents from Hostinger in a United States data centre.
• AI processing and a second copy of the backups are on servers ServAIceDesk operates in Toronto, Ontario, Canada. The two locations are connected by an encrypted private network.
• The service providers that handle personal information, and where, are listed in our Privacy Policy.

Backups and recovery

• The database and uploaded files are backed up every night, kept for 14 days on the server and copied over an encrypted connection to Toronto, where 30 days are kept.
• Every night’s backup is automatically restored into a separate database to prove it is complete and usable, and backup failures alert us.
• Backup files are readable only by the system that makes them.

Who at ServAIceDesk can access your data

• Administrative access to the servers is limited to the ServAIceDesk operator, using SSH keys.
• The operator console requires a password and two-step verification, and records every action it takes on a customer.
• We look at a service desk’s content only to give support you ask for, to keep the service secure and working, or when the law requires it.

Incident response

• Automated monitoring and intrusion detection alert us to outages and suspicious activity at any hour.
• If a breach affects your data, we notify you without undue delay. Where personal information is at real risk of significant harm, we also report it to the Office of the Privacy Commissioner of Canada and notify affected people, as Canadian law requires.

AI and your data

• The AI models run on servers ServAIceDesk operates in Toronto, Canada, reached over an encrypted private connection. Case content is not sent to third-party AI providers, and it is not used to train models.
• AI suggests, drafts and classifies. It never sends a reply or runs an action on its own unless your automation policy allows it, and every AI request and outcome is recorded.
• Each organization has a daily AI allowance, so one runaway integration cannot affect anyone else.

Audit trail and control

• Status changes, approvals, AI requests, automation runs and settings changes are recorded with who did it and when, and can be exported.
• Automation runs only inside your approval policy, with kill switches, and an agent can take any case out of automated handling.
• Connections to private systems are allowed only to destinations an operator approves, with certificate pinning.

Your data stays yours

• Export your data, set retention periods, place legal holds and handle deletion requests from your own settings.
• Requesters can see and withdraw their own privacy requests.
• When a trial ends without a plan, the service desk and its data are deleted on the date shown in your settings.

Web and email protections

• A strict Content Security Policy and frame protections on the website and service desks.
• Incoming email is accepted only through authenticated, signed deliveries from our mail provider, and every case gets its own unguessable reply address.
• Automated abuse protection blocks repeated attacks at the network edge.

Reporting a vulnerability

If you believe you have found a security problem in ServAIceDesk, email security@servaicedesk.com with the steps to reproduce it. We read every report, confirm we received it, and keep you informed while we fix it.

• Test only with accounts and service desks you own. Never access, change or delete another organization's data.
• Do not degrade the service. High-volume automated scanning is blocked automatically and is not needed to report an issue.
• Give us a reasonable time to fix the problem before you publish anything about it.

Our contact details for security researchers are also published at /.well-known/security.txt. For privacy questions write to privacy@servaicedesk.com, and for anything else support@servaicedesk.com.