Encryption and access

Overdesk holds the keys to your help desk and your Anthropic account, so how it stores them matters as much as how it handles conversations. This page covers stored credentials, how people sign in, and how each workspace is kept apart from every other.

Stored credentials

Help desk credentials, your Anthropic API key, the keys and tokens for the other services you connect, and webhook signing secrets are encrypted at rest with AES-256-GCM using a key unique to your workspace. Each kind of secret gets its own key, so a secret stored for one workspace cannot be decrypted with another workspace's key.

Once you save your Anthropic API key, the dashboard never shows it again. To change it, paste a new one over it. See Add your Anthropic API key.

Signing in

Everyone signs in with a link emailed to them. The link works once and expires after 15 minutes. Overdesk gives the same answer whether or not an address has an account, so the sign-in page cannot be used to find out who is on your team.

A session lasts 24 hours from sign-in, and activity does not extend it. After that, you sign in again with a new link. The session cookie is HttpOnly, Secure and SameSite=Lax.

Who can do what

Each person has one role: Owner, Admin, Agent or Viewer. Overdesk enforces roles on its servers, not only in the dashboard. Removing someone from the workspace ends their sessions at once. A role change takes effect the next time that person signs in. See Roles and permissions.

Workspace isolation

Every query Overdesk runs against workspace data is limited to your workspace, and an automated test reads the queries written in Overdesk's code and fails when one is missing that limit. A few operations are deliberately platform-wide, such as the daily retention sweep and signing in, which happens before Overdesk knows your workspace. None of them can show one workspace's content to another.

Webhooks and traffic

Every event your help desk sends to Overdesk is checked against a signing secret for your workspace, and an unsigned or mismatched event is rejected. See Real-time updates with webhooks.

All traffic to Overdesk runs over HTTPS. Overdesk's application and database run in the United States, and the Privacy Policy lists where each sub-processor runs. The security page goes into more detail on each of these points.