Trust
Security
Your agent handles your content and your customers’ conversations, so keeping them safe is part of the product. Here’s how IntelliDesk protects them today.
The dashboard, the chat widget and the help page are all served over HTTPS, so data is encrypted on its way to and from us.
Passwords are hashed with scrypt and a unique salt for every user. We never store or see your actual password.
Every request is checked against your workspace membership, so one workspace can’t see another’s agents, content or chats.
Your content and your visitors’ chats are only used to run your agent. We don’t use them to train AI models.
Your account
- Sessions use signed, HttpOnly cookies that are only sent over secure connections. Signing out or resetting your password ends your sessions.
- New accounts confirm their email address before their agent answers the public.
- Password reset links are sent by email and expire after one hour.
- Sign-in and password reset attempts are rate limited.
Integrations
API keys and tokens you add for integrations are only used by our servers to talk to that service, and they’re never sent back to your browser. Webhook signing secrets are the one exception: editors and admins can see them, so your developers can check that deliveries really come from us. View-only members can’t.
Where your agent can run
- Allowed domains limit which websites can load your chat widget and help page.
- Private mode blocks your agent from answering on any site you haven’t approved.
- Identity verification (a signed token from your server) stops visitors from pretending to be one of your signed-in users.
- Public chat is rate limited to protect your agent and your message credits from abuse.
AI providers and payments
Replies are written by AI model providers such as Anthropic or OpenAI. For each reply we send what the model needs to answer well: the conversation so far, your agent’s instructions, the most relevant passages from your content, and details the visitor shared or your site passed in, such as their name or the page they’re on. Card payments are handled by Stripe, and card numbers never touch our servers. See the full list of the providers who help us run IntelliDesk in our subprocessors list.
Compliance
IntelliDesk doesn’t hold SOC 2, ISO 27001 or HIPAA certification today. We’re working toward SOC 2. For details on how we handle personal data, read our Privacy Policy.
Report a security issue
If you think you’ve found a vulnerability, use our contact form with the details and steps to reproduce it. Please give us a chance to fix it before sharing it publicly. We’re grateful for every report.