DPA

For the conversations, cases and customer records of the people who contact you, you are the controller and we are the processor. For account data about your own agents and administrators, we are the controller.

We process data on your documented instructions, which are the configuration of your account: the channels you connect, the permissions you set, the retention periods you choose, the automation you enable and the integrations you authorise.

We do not process it for any other purpose, and we do not use it to train models made available outside your account.

Encryption in transit and at rest. Isolation between organizations, enforced at the record level — cross-organization reads are not a permission anybody can be granted.

Credentials for connected mail, finance and customer systems held only by the services that require them, never exposed to a browser and never written to logs.

Access to production restricted, time-bound, logged and reviewed. Every consequential action recorded with its actor, its inputs and its result, including actions taken by automation rules.

Assistant queries execute with the permissions of the person asking, through the same checks as every other read. In the customer portal that is the customer's own scope. There is no separate AI permission model, because a second model would eventually diverge and the divergence would be a breach.

Content held in the system — message bodies, attachments, imported articles — is treated as data and cannot act as an instruction to the assistant. In a support product this matters particularly, because anybody who can contact you can introduce content.

Categories marked sensitive are excluded from assistant processing by default.

We use the sub-processors listed on the subprocessors page. We give notice before adding one, and each is engaged under terms no weaker than these, including the prohibition on training.

We assist with data subject requests, impact assessments and incident notification within the timelines your agreement sets. Because your customers' requests come to you, that assistance is oriented towards helping you answer them.

Because changes, approvals and automated actions are all recorded with their actor, most audit questions about a specific case can be answered from the record rather than by investigation.

On termination, data is returned or deleted at your election within the period your agreement sets. Export remains available throughout the term and during any wind-down period.