Security Overview

1. Our approach

Security is part of how HandyDesk is designed and operated, not a promise that incidents can never happen. We limit access, isolate operator data, protect credentials, monitor the service, and review safeguards as the product changes.

2. Core safeguards

• Tenant isolation and access controls designed to keep one operator's records from being available to another.
• Encryption in transit for supported network connections and protected storage for sensitive credentials.
• Logging and monitoring for service reliability, security events, abuse, and troubleshooting.
• Backups and recovery measures designed to support continuity and recovery while preserving access restrictions.
• Limited human access based on support, security, abuse-prevention, or legal need.

3. Google and connected-service credentials

HandyDesk stores OAuth credentials in protected form and uses the granted permissions only for the connected features the operator chooses. Disconnecting Google stops future access and makes the associated OAuth credentials unusable after normal operational delay.

Revoking access does not by itself delete records already copied, created, sent, or saved as part of the operator's HandyDesk business history. See Data Requests & Deletion for both steps.

4. What operators control

Operators are responsible for protecting their passwords, devices, email accounts, connected services, and team access. Remove access when a team member no longer needs it, review customer-facing actions, and report suspected unauthorized access promptly.

5. Report a security concern

Email info@handydesk.app with the subject “HandyDesk security report.” Include the affected page or feature, what you observed, and safe reproduction steps. Do not access another person's data, disrupt the service, or include secrets or customer data that are not necessary to explain the issue.

Existing operators may also use Help & Feedback inside HandyDesk for account-specific concerns.