Hosting
SquawkDesk runs on dedicated servers in the United States operated by Inflight Technology. Each customer's data is isolated by account in the database; every query is scoped to your helpdesk.
Accounts
- Passwords are hashed with bcrypt. Minimum length 10.
- Two-factor authentication with any TOTP authenticator app. Recovery codes are hashed.
- Login throttling and lockout after repeated failures. Changing a password signs out all other sessions.
- Email and SMS verification and a card on file at signup, which keeps abusive accounts out.
Data
- Mailbox credentials and OAuth tokens are encrypted with AES-256-GCM before they reach the database.
- Attachments, logos and raw email archives are stored in encrypted object storage, not in the database, and served through short-lived signed links.
- All traffic is TLS. Session cookies are HttpOnly and SameSite.
- Administrative actions are written to an audit log you can review in Settings.
- You can export all of your data as JSON at any time, and deleting your account removes it.
Platform operations
- Nightly database backups retained for 30 days.
- Platform staff can open a customer account only through an audited impersonation action, and you will see it in your audit log.
- Webhook payloads are signed with HMAC-SHA256 so your systems can verify them.
Reporting a problem
Email [email protected]. We respond within two business days.
SquawkDesk