Your business data, and the promises we make about it.

Settings → Data & privacy → Export everything builds a ZIP of your entire workspace as CSV files: support tickets and their full message history, contacts, invoices, estimates, line items, payments, jobs, timesheets, expenses, reviews, help-center articles, an index of your media library, and your team roster.

The archive includes a README explaining every file. If any part of it couldn't be included, that is stated at the top in plain language rather than left for you to notice - an export that looks complete but isn't would be worse than no export.

Nothing in it is encrypted or locked to us. It opens in Excel, Numbers or Google Sheets and can be imported anywhere.

Some things are stored so that nobody can read them back out - not you, not our support team, not an attacker who reached the database:

• Passwords are hashed with bcrypt. We cannot tell you your password; we can only help you set a new one.
• Two-factor secrets are encrypted, and recovery codes are stored only as hashes - each one works once.
• API keys are stored as a hash plus a short prefix for display. The full key is shown once, when you create it.
• Connected-service tokens - your Shopify token, email credentials, affiliate tax IDs - are encrypted at rest with AES-256-GCM.

None of these are ever included in a data export, for the same reason.

Every query in CustoDesk is scoped to your workspace. Asking for a record that belongs to someone else doesn't return "access denied" - it returns "not found", so nobody can even learn whether a given record exists.

Inside your workspace, access is per-area: you decide who can see support, money, jobs, contacts or marketing, at none / view / manage. Those checks run on the server, not by hiding buttons in the browser.

Sessions expire on their own: one day by default, thirty if you tick "remember this device". Expiry is checked on the server every time, so an old token doesn't keep working just because it's still in a browser.

CustoDesk uses Claude (Anthropic) for reply drafts, summaries, triage, help-center answers, receipt scanning and a few other features. Two things are worth knowing.

You can turn it off completely. Settings → AI Copilot has a master switch, a toggle for every individual AI feature, and a monthly cap you set yourself. With AI off, those features fall back to non-AI behavior - nothing breaks and nothing errors.

You cannot be surprised by an AI bill. Set your cap to "stop at the limit" and AI switches itself off for the rest of the month rather than running up an overage. We email you before you get there, either way.

CustoDesk is HTTPS-only and asks browsers to enforce that themselves - HSTS is sent with a two-year max-age, covering subdomains, on the preload list. A downgrade to plain HTTP isn't something an attacker can offer your browser.

• A Content-Security-Policy restricts where scripts, styles and connections may come from, so injected content has nowhere to call home.
• Framing is denied. The app refuses to load inside someone else's page, which is what clickjacking needs. Only the embeddable chat widget is framable, because that is its job.
• MIME sniffing off, referrer trimmed - nosniff plus a strict-origin referrer policy, so your workspace URLs don't leak to third-party sites.
• Session cookies are HTTP-only and same-site, and carry the __Secure- prefix - a name browsers refuse to accept over anything but HTTPS. Page scripts can't read them and another site can't ride them.

Anything arriving from another service is proved before it is believed, and anything we send can be proved by whoever receives it.

• Incoming Shopify webhooks are HMAC-verified against the raw request body. An unsigned or altered payload is discarded before it can touch your data.
• Outgoing webhooks are signed per endpoint with a timestamped SHA-256 signature, so your systems can confirm a call really came from us. Endpoints must be HTTPS.
• Inbound email is checked for DMARC before a contact is ever treated as verified - someone spoofing your customer's address doesn't inherit their identity.
• Every signature and token comparison is constant-time, so timing can't be used to guess a secret one character at a time.

Anything reachable without a login is treated as hostile until it proves otherwise. Every public endpoint validates its input against a strict schema, so malformed or unexpected fields are rejected rather than interpreted.

The REST API authenticates by hashed key, requires the API app to be switched on, and is rate-limited per workspace. The chat widget and CSAT surveys are rate-limited too, and a visitor who types a name and email into a chat box is recorded as unverified - self-asserted identity never quietly becomes a trusted contact record.

If you believe you've found a security issue, email security@custodesk.com with enough detail to reproduce it. We'll confirm we received it, keep you updated while we fix it, and we won't pursue anyone who reports in good faith and gives us reasonable time before going public.