This page describes the security controls and operating practices nabudesk uses to protect customer workspaces. It is our public trust overview and is separate from the in-app account security settings available after you sign in.
nabudesk is built as a multi-tenant customer support platform with defense-in-depth controls across identity, application, infrastructure, and operations. We design for confidentiality, integrity, and availability of workspace data while giving customers administrative controls over their agents and configurations.
This page is informational and does not create warranties beyond those in our Terms of Service or a separately executed enterprise agreement.
Access to customer workspaces requires authenticated sessions. We support strong authentication options including password policies, multi-factor authentication, recovery codes, and passkeys where enabled.
Role-based permissions and group scoping help limit what agents and administrators can view or change. Session management allows users to review and revoke active sessions from account security settings after sign-in.
We apply secure development practices including code review, dependency awareness, and environment separation for development and production systems.
Browser security headers, input validation, and authorization checks are used to reduce common web application risks. Public marketing and legal pages are intentionally accessible without authentication; product data routes are not.
Customer data is protected with encryption in transit using TLS for supported connections. Access to production systems and operational tools is restricted to authorized personnel with a business need.
Backups and operational logs are handled according to retention and access policies designed to support recovery and investigation while limiting unnecessary exposure.
nabudesk runs on reputable cloud infrastructure providers. We rely on provider controls for physical security, network isolation primitives, and platform availability, complemented by our own application-layer protections and monitoring.
Secrets and credentials are managed through environment configuration and operational controls rather than being embedded in client-facing code.
We maintain application and security-relevant logging to support troubleshooting, abuse detection, and incident investigation. Audit-oriented records help customers and operators understand significant account and workspace activity.
We maintain an incident response process for detecting, triaging, containing, and remediating security events. Where a personal data breach affecting customers is confirmed and notification is legally required, we will notify affected customers without undue delay and provide information reasonably available at the time.
We use carefully selected subprocessors for hosting, email delivery, authentication support, observability, and billing. Vendors are reviewed for security and confidentiality obligations appropriate to the services they provide.
Security is shared. Customers control their agent roster, permissions, ticket content, retention choices, and outbound communications. Customers should:
Our Privacy Policy, Terms of Service, and Cookie Notice describe how we process data and the contractual boundaries of the service. Enterprise customers may request additional security review materials under NDA where available.
Customers remain responsible for determining whether nabudesk is suitable for their industry-specific regulatory obligations.
If you believe you have found a security vulnerability in nabudesk, contact [email protected] with enough detail for us to reproduce and assess the issue. Please avoid accessing or modifying data that is not yours and give us a reasonable opportunity to investigate before public disclosure.
For security questionnaires, incident notices, or trust reviews, contact [email protected]. For account-level MFA, passkeys, and session management after sign-in, use Account Security inside the product.