Your business data, and the promises we make about it.

Settings → Data & privacy → Export everything builds a ZIP of your entire workspace as CSV files: support tickets and their full message history, contacts, invoices, estimates, line items, payments, projects, timesheets, expenses, reviews, help-center articles, an index of your media library, and your team roster.

The archive includes a README explaining every file. If any part of it couldn't be included, that is stated at the top in plain language rather than left for you to notice - an export that looks complete but isn't would be worse than no export.

Nothing in it is encrypted or locked to us. It opens in Excel, Numbers or Google Sheets and can be imported anywhere.

Everything you put into CustoDesk belongs to you, and your most sensitive details are locked the moment they are saved:

• Passwords are scrambled with bcrypt, which cannot be undone. If you forget yours, you simply set a new one.
• Two-factor secrets are encrypted, and recovery codes are stored scrambled and work once each.
• API keys are stored scrambled, with a short prefix so you can tell them apart. The full key is shown once, when you create it.
• Connected accounts - your Shopify store, your email accounts, the calendars you link, and your affiliates' tax IDs - are encrypted with AES-256-GCM.

Data exports leave them out too.

Your workspace is kept apart from every other business on CustoDesk. Every page, search and report reads from your workspace alone, so everything you see is yours.

Inside your workspace, access is per-area: you decide who can see support, money, projects, contacts or marketing, at none / view / manage. Those checks run on the server, not by hiding buttons in the browser.

Sessions expire on their own: one day by default, thirty if you tick "remember this device". Expiry is checked on the server every time, so an old token doesn't keep working just because it's still in a browser.

CustoDesk has AI built in for reply drafts, summaries, sorting new messages, help-center answers, receipt scanning and a few other features. You decide how much of it you use.

Turn it on or off whenever you like. Settings → AI Copilot has a master switch, a toggle for every AI feature, and a monthly cap you set yourself. With AI off, those features carry on without it and nothing breaks.

Your Custo conversations stay yours. CustoDesk never reads your conversations with Custo unless you send one to us. To make Custo better we see only what was asked, with names, emails, phone numbers and amounts taken out and nobody attached.

Your AI spending stays where you set it. Set your cap to "stop at the limit" and AI pauses for the rest of the month instead of going over. We email you before you get there, either way.

CustoDesk is HTTPS-only and asks browsers to enforce that themselves - HSTS is sent with a two-year max-age, covering subdomains, on the preload list, so everything between your browser and CustoDesk travels encrypted, every time.

• A Content-Security-Policy sets exactly where scripts, styles and connections may come from.
• Framing is denied. The app refuses to load inside someone else's page, which is what clickjacking needs. Only the embeddable chat widget is framable, because that is its job.
• MIME sniffing off, referrer trimmed - nosniff plus a strict-origin referrer policy, so a link out of CustoDesk carries only our address, never the page you were on.
• Session cookies are HTTP-only and same-site, and carry the __Secure- prefix - a name browsers accept only over HTTPS, so your sign-in only ever travels to CustoDesk, encrypted.

Anything arriving from another service is proved before it is believed, and anything we send can be proved by whoever receives it.

• Incoming Shopify webhooks are HMAC-verified against the raw request body. An unsigned or altered one is turned away on arrival.
• Outgoing webhooks are signed per endpoint with a timestamped SHA-256 signature, so your systems can confirm a call really came from us. Endpoints must be HTTPS.
• Inbound email is checked for DMARC before a contact is ever treated as verified - someone spoofing your customer's address doesn't inherit their identity.
• Every signature and token comparison is constant-time, so timing can't be used to guess a secret one character at a time.

Anything reachable without a login is treated as hostile until it proves otherwise. Every public endpoint validates its input against a strict schema, so malformed or unexpected fields are rejected rather than interpreted.

The REST API authenticates by hashed key, requires the API app to be switched on, and is rate-limited per workspace. The chat widget and CSAT surveys are rate-limited too, and a visitor who types a name and email into a chat box is recorded as unverified - self-asserted identity never quietly becomes a trusted contact profile.

If you believe you've found a security issue, email security@custodesk.com with enough detail to reproduce it. We'll confirm we received it, keep you updated while we fix it, and we won't pursue anyone who reports in good faith and gives us reasonable time before going public.