Security
Support tickets hold your customers' problems, and often their personal details. Here is how TicketingSystem keeps them apart, keeps them safe, and keeps them recoverable.
Workspace isolation
- Every tenant row carries its workspace, and Postgres row-level security, forced on every tenant table, filters each query to the workspace in the request.
- The app connects with database roles that cannot bypass those policies and own nothing; a separate role runs migrations.
- Tests in every build check that each table has its policy, and that one workspace's ids return nothing from another.
Accounts and sign-in
- Two-factor sign-in with authenticator apps and backup codes for every account; Pro and Business workspaces can require it of all members.
- Customers use the help center with a separate, passwordless session. They never get an agent account.
- The active workspace comes from the address you visit and is checked on every request, never trusted from the browser.
Your data
- All traffic is encrypted in transit, and Google Cloud encrypts data at rest.
- Attachments live in a private bucket and are reached only through short-lived signed links issued to people allowed to see them.
- Attachments are scanned for malware, and anything the scanner flags or cannot check is never served.
- Export a whole workspace or one customer's history at any time, erase a contact on request, and delete a workspace with everything in it.
Backups and availability
- Hosted on Google Cloud in the United States (us-central1), on a high-availability database with a standby in a second zone.
- Daily backups kept for 14 days, and point-in-time recovery to any moment in the last 7 days.
- Restore drills restore a backup into a separate instance and check it holds everything it should.
- Deleted attachments stay recoverable for 7 days.
- Inbound mail is trusted only when the sender's domain passes DMARC, and it is shown as plain text, never as HTML.
- Reply addresses are signed, and a reply from anyone but the ticket's requester or CCs, or one that fails DMARC, is held as an internal note instead of reaching the conversation.
- Bounces and spam complaints put an address on a suppression list automatically.
Application security
- A strict content security policy with per-request nonces, and origin checks on every form and upload.
- Incoming webhooks are verified by signature; outgoing webhooks are signed and refuse private and cloud-metadata addresses.
- Error details stay out of public responses; they go only to our logs.
Operations
- Secrets live in Google Secret Manager, and each service reads only its own.
- Production changes only through a release built from a commit that staging already ran.
- Deploys authenticate with short-lived workload identity, not stored keys.
Staff access
- Our staff can view a workspace only to help with a problem, read-only and for at most 30 minutes at a time.
- Each visit is recorded in your workspace's audit log as well as ours.
Answer faster. Ship the fix. Tell everyone who asked.
Every new workspace gets 14 days of Business, with no card needed. Keep the Free plan afterwards, or pick a paid plan when you are ready.