Security and privacy overview

Sign-in

• Agents and admins sign in with email and password. Passwords need at least 10 characters and are checked against known data breaches.
• After 10 wrong passwords an account is locked for 15 minutes. A sign-in from a new device is announced by email.
• Sessions end after 8 hours without activity, or after 30 days with "keep me signed in".
• Agents can protect their sign-in with an authenticator app or a passkey, and admins can require it. See Two-step verification and passkeys.
• Admins set password strength, session timeouts and allowed invitation domains in security policies.
• Agents can sign in with Google or Microsoft.
• On Pro and up, agents can sign in with your identity provider over OpenID Connect.
• On Enterprise, agents can sign in with your identity provider over SAML, and you can provision them with SCIM.
• Customers sign in to the help centre with an emailed link, or with your own login per brand.

Access control

• Roles decide which tickets each agent sees and what they can do. See Roles and permissions.
• On Enterprise, an IP allowlist limits where agents can sign in from.
• ChaosDesk support can only see your workspace when an admin allows it, for a limited time.

Your data

• Secrets such as API credentials and connector keys are encrypted with a key that belongs to your workspace alone.
• Every workspace is isolated from the others in the database.
• The admin audit log records every configuration change, and the access log records who opened which ticket.

Personal data (GDPR and POPIA)

• Automatic redaction removes card numbers and ID numbers before they are stored.
• Retention policies delete or anonymise old closed tickets.
• Erasure requests remove a customer's data, approved by a second admin.
• You can export everything held about a customer.

More detail for your security team is on our security page, with the data processing agreement and the list of subprocessors.

Related

• Compliance tools
• Handle a GDPR request
• Review the audit log