Get early access
In this section (15)

Security and privacy overview

How ChaosDesk protects sign-in, your data and your customers' personal data, and where to set it up.

2 min read

Sign-in

  • Agents and admins sign in with email and password. Passwords need at least 10 characters and are checked against known data breaches.
  • After 10 wrong passwords an account is locked for 15 minutes. A sign-in from a new device is announced by email.
  • Sessions end after 8 hours without activity, or after 30 days with “keep me signed in”.
  • Agents can protect their sign-in with an authenticator app or a passkey, and admins can require it. See Two-step verification and passkeys.
  • Admins set password strength, session timeouts and allowed invitation domains in security policies.
  • Agents can sign in with Google or Microsoft.
  • On Pro and up, agents can sign in with your identity provider over OpenID Connect.
  • On Enterprise, agents can sign in with your identity provider over SAML, and you can provision them with SCIM.
  • Customers sign in to the help centre with an emailed link, or with your own login per brand.

Access control

  • Roles decide which tickets each agent sees and what they can do. See Roles and permissions.
  • On Enterprise, an IP allowlist limits where agents can sign in from.
  • ChaosDesk support can only see your workspace when an admin allows it, for a limited time.

Your data

  • Secrets such as API credentials and connector keys are encrypted with a key that belongs to your workspace alone.
  • Every workspace is isolated from the others in the database.
  • The admin audit log records every configuration change, and the access log records who opened which ticket.

Personal data (GDPR and POPIA)

  • Automatic redaction removes card numbers and ID numbers before they are stored.
  • Retention policies delete or anonymise old closed tickets.
  • Erasure requests remove a customer’s data, approved by a second admin.
  • You can export everything held about a customer.

More detail for your security team is on our security page, with the data processing agreement and the list of subprocessors.

Was this article helpful?