Trust & Security
What’s actually built and verified today, not a roadmap, not marketing claims.
Ten things you can rely on.
- Tenant scope on every queryBacked by tests that try to break it.
- Per-agent client accessNew agents see nothing until granted.
- HTTPS everywhereThe site and the app.
- Signed inbound emailHMAC-SHA256, unsigned rejected.
- Login lockoutRate-limited after failed attempts.
- Sessions end on password changeImmediately, everywhere.
- Two-step sign-inWith an authenticator app.
- Email confirmationOn every new sign-up.
- Export and deletionSelf-serve from Settings.
- DPA on requestSigned before your first client.
No SOC 2 or ISO 27001 certification, and no formal uptime SLA or backup-frequency guarantee yet. Contact us directly if either is a current requirement for your agency.
In detail8 sections
OverviewTenant isolationAccess controlEncryption in transitWebhook securityAccount securityGDPR & data handlingReport a security issueOverview
Boridesk exists to let one team run support for many separate client companies, which means the platform's core job is keeping each client's data walled off, both from other clients and from other agencies entirely. Here's what's actually built and verified today.
Tenant isolation
Every agency is a tenant, and every ticket, message, and client record is scoped to that tenant on every database query by default, so isolation never depends on an individual screen remembering to check. This is covered by an automated integration test suite that specifically tries to make one tenant see another's data, and confirms it can't.
Access control
Within an agency, admins control what each agent can see: agents can be scoped to specific client companies, or granted access to all of them. New agents see nothing by default until access is explicitly granted. Roles (Agent / Admin / SuperAdmin) gate administrative actions like inviting agents or changing settings.
Encryption in transit
All traffic to boridesk.com and the Boridesk app runs over HTTPS.
Webhook security
Inbound email is delivered to Boridesk over a signed webhook, verified with HMAC-SHA256. Unsigned or incorrectly-signed requests are rejected before they touch any tenant's data.
Account security
Changing your password immediately invalidates every other active session, not just on next expiry. Repeated failed login attempts trigger account lockout, and login endpoints are rate-limited. Two-step sign-in with an authenticator app is available on every account, and new sign-ups confirm their email address.
GDPR & data handling
Wherever your agency and your clients are based, your agency is the data controller for the customer data flowing through your tickets, and Boridesk acts as your processor. This applies under UK/EU GDPR, US state privacy laws like CCPA, and equivalent rules elsewhere. We will sign a data processing agreement before you onboard your first client. Email legal@boridesk.com and we'll send it.
We use a small number of infrastructure providers to run Boridesk: application and database hosting, DNS and inbound email routing with private storage for ticket attachments, and outbound email delivery. Application data is hosted in the United States; transfers are covered by the standard contractual clauses in the DPA. The specific providers are named in the DPA we send on request, and we'll give you notice before adding or changing one.
You can delete a customer's data on request, and you can export your agency's tickets, messages and client records at any time. If you need a deletion or access request actioned on our side rather than yours, email us and we'll handle it.
Found a vulnerability? Email legal@boridesk.com with details. We’ll respond, and won’t take legal action against good-faith reports.