How customer data is handled

Overdesk reads conversations from your help desk, drafts replies with a language model, and writes the drafts back to your help desk unsent. This page follows a conversation along that path and says what is protected at each step, including where the protection stops.

Where your data goes

Destination	What it receives	Whose account
Anthropic	Conversation text with recognisable details replaced, for drafts, triage, follow-up nudges, reports, analyses and Ask Overdesk	Yours, through your Anthropic API key
Voyage AI	Knowledge-base text and search queries, to power knowledge-base search. Search queries, past conversations, saved replies and connected sources have recognisable details replaced first; your documentation site and help-center articles are sent as published	Overdesk's own account
Your help desk	The finished draft, unsent, with the real details put back	Yours

Apart from the providers that run Overdesk itself, such as hosting, the database, email delivery and payments, other services receive data only once you connect them. A connected store, billing or licensing system is sent your customer's email address so Overdesk can look up their account; see Customer context. Reports and alerts you send to Slack or ClickUp show "(customer)" in place of the customer names Overdesk recognised, and contact details stay replaced. The Privacy Policy lists every sub-processor and where each one runs.

What your Anthropic account does with a request is governed by your agreement with Anthropic, because the request is made with your key.

What is replaced before the model sees it

Before any conversation text is sent to the model, Overdesk replaces recognisable personal details with stand-ins. It finds them by their shape:

• email addresses and phone numbers
• payment card numbers, IBANs and cryptocurrency addresses
• social security numbers written with dashes or spaces, or as a run of 9 digits in text that mentions an SSN, and MAC addresses
• licence keys, API keys and similar codes
• PO boxes, and street addresses introduced by a phrase such as "address:" or "lives at"

Names are replaced too when they come from a structured field: the customer who opened the conversation, anyone else on the customer's side who wrote one of its messages, and the name a connected store holds for them.

When the model replies, Overdesk puts the real values back, so the draft your agent reads is complete. Redaction is on by default for every workspace.

What it does not catch

The replacement works from patterns and structured fields, so it has limits. Treat it as a strong safety net, not as a substitute for your team's judgement about what belongs in a ticket.

• Names written only in the text. Overdesk runs no name-recognition model, so "my colleague Dave can't log in either" reaches the model with the name in it.
• Your own team's names. They go to the model as written, so it can follow who said what on a conversation several agents have answered.
• Links, IP addresses, postcodes and street addresses with no lead-in. Their patterns collide with version numbers, ticket numbers and ordinary words, so they are left intact. Treat a reset or invite link pasted into a ticket as something the model will see.
• Pictures and PDFs. Redaction reads text and cannot read inside an image, so an attachment reaches the model exactly as your customer sent it while a draft is written. You can switch this off, and turn off reading the pages customers link to, on the Customize AI page. See Pictures and links.

Stand-ins are unique to your workspace

The stand-in for a value is derived from a secret that belongs to your workspace. The same email address produces a different stand-in in every workspace, so stand-ins cannot be matched across workspaces.

What Overdesk stores

• Your knowledge base. Past conversations are redacted before they are stored, and the customer's email address is replaced with a stand-in that stays the same each time, so their conversations still group together. Name replacement from structured fields runs on text headed for the model, not on the stored copy, so a name written in a ticket's text is stored as written.
• Drafts. Each draft is stored with the real details put back, because it is the reply your team reads on the Agent drafts page and in your help desk.
• Reports and analyses. The saved copy shows the customer names the model mentioned, and contact details stay replaced. The copy sent to Slack or ClickUp shows (customer) instead.

How long each of these is kept is on Data retention. To remove one customer's data, see Erasure and deletion requests.