SecurityBuilt like real software.
Built like real software.
From day one.
We're a small team but our architecture isn't. The same patterns big SaaS uses to keep customer data isolated and auditable are wired in before the first paying customer.
Posture
How the system is built.
Encryption everywhere
TLS 1.2+ in transit. AES-256 at rest via Postgres. Stripe handles all card data; we never see PAN.
Tenant isolation
Every domain row is scoped to your organization. Postgres row-level security policies re-check tenant context on every read and write.
Webhook signatures
Every inbound webhook (Stripe, Twilio, VAPI, Clerk) verifies signature before any side effect runs.
Secrets handling
API keys live in environment variables, never in the codebase. Production secrets rotate quarterly.
Audit log
Every write to a tenant-scoped table records actor, timestamp, before/after state. Owners see their own audit log.
Soft deletes
Deletion adds a deleted_at marker — rows are recoverable for 30 days, then purged.
Human-gated transactions
Your AI employee auto-executes only inside the payment authority you set. Bigger transactions wait on the Approvals page — every decision stamped with who made it.
Authorization you configure
Admins write the rules: who can approve, spending ceilings, whether external agents or direct database access are allowed. Enforced server-side, not prompt suggestions.
Agent verification
Every agent is automatically checked on creation and every edit — role clarity, escalation paths, policy conflicts, approval-bypass attempts — with a visible verified badge.
Guarded external calls
Operator-registered endpoints and database connections are HTTPS-only, blocked from private networks, and connection strings are encrypted at rest.
Compliance
Compliance roadmap
- in progressSOC 2 Type IAuditor engaged — Q3 2026 target. Controls overview available today under NDA.
- nextSOC 2 Type IISix-month observation window begins after Type I.
- alignedGDPRData export + deletion built into the product. DPA available on request.
- alignedCCPACalifornia consumer rights honored — access, deletion, no sale of data. Privacy documentation available.
- plannedCASA (Google API security assessment)Scheduled alongside Google restricted-scope verification for Gmail/Calendar integrations.
- pending reviewSlack App DirectoryOAuth scopes + security posture prepared for Slack review.
- plannedISO 27001ISMS controls mapped; certification driven by enterprise demand.
- availablePHI-safe scheduling modeHealthcare verticals run without collecting or storing PHI; BAA requests are handled case-by-case before onboarding.
Entity
Company & legal entity
Deskwise is operated by Vellor Systems LLC, a registered U.S. limited liability company based in Cheyenne, Wyoming. We are D-U-N-S® registeredand verifiable through Dun & Bradstreet — the same business-identity standard enterprise procurement and Apple's developer program require. A capability and controls overview is available under NDA for enterprise evaluations.
Disclosure
Reporting issues
Found a vulnerability? Email contact@deskwise.co. We acknowledge within 24 hours and patch critical issues within 72.