Hosting
In the United States.
Overdesk’s application runs on Fly.io and its database on Neon, both in the United States. If you use Overdesk from elsewhere, your data is processed in the US.
Drafting, triage, report commentary and analysis run on your own Anthropic API key, under your own agreement with Anthropic.
Protection
Encrypted, and kept to your workspace.
All traffic is over TLS.
Help desk credentials, model API keys and webhook signing secrets are encrypted at rest with AES-256-GCM, under a key derived per workspace and per purpose.
Every query against workspace data is scoped to a single workspace, and a test gate fails our build if a new query is written without that scope. The handful of deliberate exceptions are listed in our implementation notes.
Inbound webhooks are signature-verified, and an unsigned or wrongly signed event is rejected.
Before the AI reads a ticket, Overdesk swaps out the email addresses, card numbers, licence and API keys, and labelled passwords customers paste in. It does not catch everything. How redaction works.
Compliance
Processor for your customers’ data.
For your customers’ personal data inside your support conversations, you are the controller and Overdesk is the processor (GDPR Article 28).
If you need a separate data processing agreement, email privacy@overdesk.io. Enterprise customers may ask for advance notice of new sub-processors, and object to them, under the DPA.
Overdesk holds no third-party security certifications today: it is not SOC 2 audited or ISO 27001 certified, and does not offer a HIPAA BAA.
Sub-processors
Who processes your data.
| Sub-processor | Purpose | Data | Location |
|---|---|---|---|
| Anthropic | Draft/analysis generation | Support text (pseudonymised), attached pictures (not pseudonymised, see Privacy Policy section 4), and code from any repository you connect, under your own API key | US |
| Voyage AI | Text embeddings for search | Support content (pseudonymised), under an Overdesk-owned key | US |
| Neon | Primary database | Account data + support content | US |
| Fly.io | Application hosting, and the test copies of WordPress (Privacy Policy section 4) | Account data + support content in transit; on a test site, only the pseudonymised steps the model takes | US |
| Cloudflare | Serves our websites, overdesk.io and docs.overdesk.io, and counts their visits (Privacy Policy section 7) | A visitor's IP address and browser details as each page loads. Nothing from your Overdesk account or your support content | US, served from Cloudflare's worldwide network |
| Cal.com | Demo booking on overdesk.io (optional) | The name, email address and any note a visitor enters on our booking page, and the time they pick. Nothing from your Overdesk account or your support content | US |
| Resend | Transactional email | Account email addresses | US |
| Stripe | Payments | Billing/account data | US |
| Slack | Report delivery (optional) | Support content you route to your own Slack workspace | US |
| ClickUp | Report delivery (optional) | Support content you route to your own ClickUp workspace | US |
| GitHub | Issue creation (optional) | The text of an issue your team writes and confirms, in your own repository | US |
| Linear | Issue creation (optional) | The text of an issue your team writes and confirms, in your own workspace | US |
| Atlassian (Jira) | Issue creation (off unless you turn it on) | The text of an issue your team writes and confirms, in your own project | Your Jira site's own region |
| Knowledge source (optional) | The documents you pick, read under Overdesk's own Google application, and the email address of the account that authorised it. Google records that Overdesk opened the file; the access reaches nothing else in your Drive | US | |
| WooCommerce | Customer lookup (optional) | Your end customer's email address, sent to your own store to find their orders | Wherever you host your store |
| Shopify | Customer lookup (optional) | Your end customer's email address, sent to your own Shopify store to find their orders | Your Shopify store's own region |
| Stripe, as your own account | Customer lookup (optional) | Your end customer's email address, sent to your own Stripe account to find their subscription and invoices | US |
| Freemius | Customer lookup (optional) | Your end customer's email address, sent to your own Freemius account to find their licences and the sites they installed your product on | US |
Printed from section 6 of our Privacy Policy, which is the one list we keep.
Found a security problem?
Email security@overdesk.io with what you found and how to reproduce it.