Security
Each helpdesk's tickets stay its own.
Support tickets are full of names, addresses and order details. The helpdesk keeps each brand's tickets apart in the database, encrypts the tokens that reach your mailbox, and keeps message text out of logs and background jobs.
One helpdesk per request
Postgres row-level security limits every request to the helpdesk it belongs to, under a database role that cannot switch the limit off.
Mailbox tokens encrypted
The tokens that let the helpdesk read and send a Gmail mailbox are encrypted with AES-256-GCM before they are stored, next to that helpdesk's rows.
Google sign-in and two-factor
Owners sign in with Google. Every account can add an authenticator app for two-factor sign-in, and repeated failed sign-ins lock the address for a while.
Protections in every helpdesk
On from the first sign-in. None of them is a setting you have to find.
Row-level isolation
Postgres limits every query to one helpdesk.
Encrypted mailbox tokens
AES-256-GCM before they are stored.
No message text in logs
Logs, jobs and events carry ids only.
Two-factor sign-in
Any account can add an authenticator app.
Google sign-in for owners
Owners sign in with their Google account.
Lockout on guessing
Five failed sign-ins lock an address for 15 minutes.
Signed webhooks
Your server can check each delivery came from us.
Keys stored as hashes
An API key is shown once and never stored in full.
Agents and roles
Everyone signs in as themselves
There are no shared logins. Each person has their own account and a role in each helpdesk, and an API key carries the role of the agent it belongs to.
- Admin
- Settings, agents and roles, teams, rules, fields, surveys, integrations and API keys for anyone
- Lead agent
- Everything an agent does, plus macros, views, view sections and managing tags
- Agent
- Reply, note, tag, assign, snooze and close tickets; edit customers
- Observer
- Read tickets, customers and reports without changing anything
The details
How each part is handled
How helpdesks are kept apart
- Every table that holds helpdesk data carries the helpdesk's id, and Postgres row-level security limits each request to one helpdesk.
- The application connects as a database role that cannot bypass row-level security.
- An API key belongs to one agent in one helpdesk, and the key alone decides which helpdesk a request reads. Tests check that one helpdesk's key never reads another's rows.
Customer messages and personal data
- Message bodies, customer names, email addresses, phone numbers and street addresses live only in the helpdesk's own tables, under row-level security.
- Logs, background job payloads, events and the audit log carry ids. They never hold message text, names or addresses.
- Attachments are stored with the ticket and served from a link that carries its own unguessable token.
Mailbox access
- Connecting a mailbox asks Google for one permission, gmail.modify (read, label and send mail), and the helpdesk checks the mailbox address against the account that granted it.
- The mailbox's refresh token is encrypted with AES-256-GCM under a key kept in Vercel's encrypted environment settings, never on a Growth Dept machine.
- Disconnecting a mailbox stops the sync. You can also remove the helpdesk's access from your Google account settings at any time.
Accounts and sign-in
- People join by invitation. An invite is a single-use link that expires after 48 hours.
- Owners sign in with Google. Anyone can turn on two-factor sign-in with an authenticator app.
- Five failed sign-ins within 15 minutes lock that email address for 15 minutes.
- Sessions use an HttpOnly cookie that lasts up to 30 days, and every form that changes something is protected against cross-site requests.
API keys
- A key is shown once when it is created and stored only as a hash.
- A key acts as the agent it belongs to, with that agent's role, and can be revoked at any time.
- Each key may make 40 calls in any 20 seconds; past that the API answers 429 and says how long to wait.
Staff access and the audit log
- Growth Dept staff can open a helpdesk read-only to help with support. Each such visit is written to the audit log.
- Changes to accounts, helpdesks, access and API keys are written to the audit log too.
Retention and deletion
- Deleting a customer through the API removes their messages and files.
- Owners can download an export of a helpdesk's data until they delete it. The data is permanently deleted 30 days after the deletion.
Where it runs
- The application runs on Vercel in the US East region (Washington, D.C.), and the database on Neon Postgres in AWS us-east-1.
- Platform secrets (the session key, the encryption key and the Google client secret) live in Vercel's encrypted environment settings.
Found a problem, or have a question?
Security reports and questions go to support@growthdept.ai. Put “Security” in the subject line and we will answer from a person, not a form.