Your customers' conversations, handled properly
Support software sits on top of everything your customers tell you — order numbers, email addresses, complaints, occasionally things they would not want repeated. This page describes exactly how EasyChatDesk protects it, in plain language and without marketing padding.
Last reviewed: August 7, 2026
How the platform is built
Six controls that are in place today, not on a roadmap.
Encrypted in transit
Every connection to EasyChatDesk — the dashboard, the REST API, the chat widget and the realtime WebSocket — runs over HTTPS/TLS with certificates issued and auto-renewed by Let's Encrypt. There is no unencrypted endpoint to fall back to.
Databases are never public
PostgreSQL and Redis run on a private internal network and are not exposed to the internet. The host firewall accepts SSH, HTTP and HTTPS only — the database ports are closed at the perimeter, not merely password-protected.
Passwords are never stored
Account passwords are hashed with bcrypt and are unreadable to us. Nobody at EasyChatDesk can retrieve your password — a reset is the only recovery path, which is exactly how it should work.
Domain-bound widget sessions
The chat widget authenticates with short-lived signed session tokens bound to the domain that requested them. A token lifted from your site cannot be replayed from somebody else's, so your chat endpoint cannot be used as an open relay.
Rate limiting at every layer
The REST API enforces per-IP throttling. The WebSocket layer caps concurrent connections per IP, guards against connection floods and token-bucket rate-limits inbound messages per connection. Abuse gets absorbed before it reaches your inbox.
We never touch card data
Billing runs through Stripe, a PCI DSS Level 1 service provider. Card numbers are entered directly into Stripe's hosted checkout and never pass through — or get stored on — EasyChatDesk servers.
What we do not claim
Plenty of support vendors decorate a security page with badges. We would rather tell you where we actually stand, because you are going to find out either way during procurement.
- EasyChatDesk is not SOC 2 or ISO 27001 certified. Those are audits of a formal compliance programme, and we have not completed one. If your procurement process requires a current SOC 2 Type II report as a hard gate, we will not pass it — and we would rather you know that now than three calls in.
- We have not published a third-party penetration test. The controls above are real and verifiable, but they have not been validated by an external assessor.
- We are not HIPAA-certified and do not sign BAAs. If you are handling protected health information in the United States, EasyChatDesk is not the right tool for those specific conversations.
What we do offer is a small, well-understood system: a single application, a private database, TLS everywhere, and a team you can actually reach. For most website owners and small businesses that is a better trade than an enterprise contract with a compliance department attached. For a regulated enterprise, it is not.
Common security questions
Who can see my conversations?
Your conversations belong to your workspace. Access is scoped by account: agents see the chats and tickets for the account they belong to, and workspace owners control who is invited. EasyChatDesk staff do not read customer conversations as a matter of routine — access happens only when you ask us to investigate a specific problem.
How are sessions authenticated?
Dashboard and API access use signed JWTs. The admin console is isolated behind a separate signing secret from the customer application, so an application token cannot be escalated into administrative access.
What happens to file attachments?
Files uploaded through chat or tickets are stored server-side and served only to authenticated members of the owning account. Uploads are size-capped at the proxy to prevent resource-exhaustion attacks.
Can I delete my data?
Yes. You can delete individual conversations and tickets from the dashboard at any time, and you can request full deletion of your workspace and its data by emailing [email protected]. See our GDPR page for the formal process and response times.
Do you sell data or train public models on my conversations?
No. We do not sell customer data, and your conversations are not used to train models that serve anyone else. Content you feed the AI chatbot is used to answer your own visitors' questions.
Reporting a vulnerability
If you believe you have found a security issue in EasyChatDesk, email [email protected] with the subject line Security. Include the steps to reproduce and, if relevant, the affected URL or account.
We aim to acknowledge reports within two business days. Please give us a reasonable window to ship a fix before disclosing publicly, and do not run tests that degrade the service for other customers or access data that is not yours.
For data protection questions specifically — DPAs, sub-processors, deletion requests — see GDPR & data protection. For how we handle personal data generally, see the privacy policy.
Support software you can actually explain to your legal team
Live chat, an AI chatbot and a help desk — with the data handling written down in plain English.
- Guided onboarding
- Scale-as-you-grow pricing
- 55+ languages
- 15-day free trial
- Cancel anytime