Security
Security that lives in the data model
ubDesk keeps every partner and customer apart in the database itself, signs people in without a third party, and records everything that matters in a log nobody can edit.
Sign-in
Authentication is built in house, so no outside identity provider holds your accounts.
- Password rules set per desk and checked against a breach list
- Two-step sign-in with an authenticator app
- Single-use recovery codes
- Lockout after repeated failures, and an email for every new device
Sessions
Every signed-in device is a session you can see and end.
- Every device listed with when it was last active
- Sign out one device, or everywhere else
- Idle timeout set per desk, with a 30 day limit on any session
- Changing a password ends every other session
- On iPhone, Face ID locks the app, and ending a session on the web signs the phone out
Data isolation
Every partner and customer is a separate tenant. Postgres row-level security filters every query, so one desk cannot read another's data even if application code makes a mistake.
- Policies on every table, checked by tests on every change
- Customers see only their own company
- Vendors see only the tickets they accepted
Audit log
The audit log is append-only. Entries cannot be edited or deleted, by anyone.
- Every change recorded with who did it and when
- Every export, download and statement recorded
- Sign-ins recorded with the device
Support access
When the ubDesk team needs to see what a person sees, it happens in the open.
- A reason is required to open a console as someone else
- A banner stays on screen for the whole session
- Every action is audited as taken on their behalf
- The session ends after 60 minutes
Files
Attachments and documents are checked before anyone can open them.
- Every upload is scanned for viruses
- Retention rules remove old data on a schedule you can see
Hosting
ubDesk needs managed Postgres and object storage and nothing specific to one vendor, so it can run in the cloud and region you choose.
- No lock-in to one cloud provider
- Health checks and incident records in the platform console
This page does not claim compliance certifications. Ask us for the security details your review needs.
Bring your security questions
We will walk your team through isolation, sign-in and audit on a call.