Security & Compliance

At Deskbolt, we take data security, privacy, and compliance extremely seriously. Our mission is to ensure that every conversation, lead, and piece of information handled by our platform is processed with the highest standards of confidentiality and integrity.

This page outlines the security measures, data protection frameworks, and compliance commitments that guide how we protect our clients and their users.

Deskbolt is built on a foundation of privacy by design and security by default. We follow four key principles:

1. Confidentiality — Data is encrypted, controlled, and never shared without authorization.
2. Integrity — All data is protected from unauthorized modification or deletion.
3. Availability — Our systems are resilient and continuously monitored for uptime and reliability.
4. Transparency — Clients always know where their data is stored and how it's used.

• Hosting: Deskbolt is hosted on Google Cloud Platform (GCP) and Amazon Web Services (AWS), two of the most secure and compliant cloud infrastructures in the world.
• Data Centers: Primary infrastructure is located in the United States. Some subprocessors are also established in the European Union (see section 12).
• Certifications: Both providers maintain ISO 27001, SOC 2, SOC 3, and GDPR compliance.
• Network Security: All internal and external communications are encrypted using TLS 1.3.
• Firewalls & Monitoring: Network firewalls, intrusion detection, and DDoS protection are in place to safeguard all traffic.

• Data in Transit: Encrypted using HTTPS (TLS 1.3).
• Data at Rest: Encrypted using AES-256.
• Access Control: Role-based access, MFA (multi-factor authentication), and restricted privileges for team members.
• Database Backups: Performed daily, encrypted, and stored in separate secure locations.
• Isolation: Each tenant's data is logically separated to prevent cross-account access.

• Regular penetration testing and vulnerability scans on production environments.
• Strict code review and deployment procedures with CI/CD security checks.
• Dependency monitoring to prevent known vulnerabilities.
• Session management and JWT token expiration for user authentication.
• Continuous monitoring of server logs for anomalies or suspicious behavior.

• Employee access to production systems is strictly limited and audited.
• All administrative actions are logged.
• Devices accessing sensitive environments must comply with security baselines (encryption, password policies, MFA).
• Staff undergo security awareness training to recognize and prevent social engineering attacks.

Deskbolt fully complies with the following frameworks and laws:

Deskbolt acts as a:

• Data Processor for client data (leads, messages, Smart Data).
• Data Controller for its own business data (website analytics, CRM, billing).

For more information, see our Privacy Policy.

• Detection: Real-time monitoring and alerting systems.
• Response: A defined incident response plan including identification, containment, eradication, and recovery.
• Notification: In the unlikely event of a data breach, Deskbolt will notify affected clients without undue delay and within 24 hours (per our Data Processing Agreement commitment), and notify supervisory authorities within the 72-hour limit set by GDPR Article 33.
• Post-incident review: Every incident triggers an internal audit and improvement plan.

Deskbolt applies strict and transparent data retention rules in compliance with the GDPR's data minimization and storage limitation principles:

• After these retention periods, data is securely deleted or anonymized.
• Clients may request deletion or export of data at any time by contacting hello@deskbolt.com.
• Upon contract termination, all data is permanently deleted within 60 days, unless longer retention is required by law.

• Deskbolt uses AI providers (OpenAI, Anthropic, Google) to analyze and summarize conversations.
• No personal data is used to train public AI models.
• All AI processing is performed under strict data processing agreements (DPAs) with each provider.
• Deskbolt retains Smart Data and conversation summaries only for client usage, analytics, and CRM synchronization — subject to the same retention limits described above.

While Deskbolt provides the technology and infrastructure, clients remain responsible for:

• Obtaining proper consent from their users (website visitors, WhatsApp contacts).
• Configuring integrations and automations in compliance with local regulations.
• Protecting credentials and access to their accounts.

Deskbolt provides default templates and compliance tools (cookie banner, privacy policy references) to assist clients.

Deskbolt works exclusively with trusted, audited subprocessors. Current subprocessors include:

This list mirrors the authoritative subprocessor table in section 6 of our Data Processing Agreement, which prevails in case of discrepancy.

Deskbolt operates on infrastructure provided by partners (Google Cloud Platform, Amazon Web Services / Neon, Stripe) that are certified to ISO 27001 (Information Security Management) and SOC 2 Type II. These certifications cover the underlying hosting, database, and payment infrastructure on which Deskbolt runs.

Deskbolt itself fully complies with the following regulatory frameworks:

• GDPR (EU General Data Protection Regulation)
• UK GDPR
• CCPA / CPRA (California Consumer Privacy Act / California Privacy Rights Act)
• U.S. state chat-recording consent laws (all-party consent, such as California's Invasion of Privacy Act): consent before the chat is recorded, and a recording notice in every other state
• PCI-DSS requirements applicable to merchants of record, with payment card data processed exclusively by Stripe (a Level 1 PCI-DSS certified service provider) — Deskbolt itself never stores cardholder data

Deskbolt continuously reviews its internal controls and is not itself certified to ISO 27001 or SOC 2 at this time. Customers requiring such third-party attestations may rely on the certifications of our infrastructure partners listed above.

If you believe you've found a security vulnerability or wish to report an incident, please contact our security team directly:

Email: hello@deskbolt.com

Subject: "Security Report"

Please include as many details as possible (description, reproduction steps, affected endpoint). We review all security reports promptly and responsibly.

Security and compliance are ongoing commitments. Deskbolt regularly audits its infrastructure, updates its policies, and enhances its safeguards to ensure the highest level of trust and protection for its clients and users.