Security & Sub-processors

This page describes how CliqDesk protects data and lists every third party that touches it. If your procurement team needs something not covered here, email hello@cliqdesk.app and ask.

Where your ticket content lives

Worth stating first, because it changes your risk assessment: CliqDesk is a customer-facing layer over your own ClickUp workspace. ClickUp is the system of record. Tasks, comments, assignees, statuses and file attachments live in your ClickUp account, under your existing agreement with ClickUp.

CliqDesk stores enough to run the portal: the ticket subject, the answers submitted to your desk form, and replies sent through the portal, alongside portal configuration, requestor accounts, the mapping between a ticket and its ClickUp task, audit records and email threading references. Keeping that locally is what lets a customer read their tickets when ClickUp is unreachable.

Uploads are passed through to the ClickUp task. A file is written to disk only for as long as the transfer takes, and deleted once it has been delivered.

Tenant isolation

Every portal is isolated from every other portal. Isolation is enforced in the application on every query rather than left to convention, and each feature ships with an automated test proving that a user of one portal receives no data from another. Those tests run on every change before it can be merged.

Encryption

• All traffic is encrypted in transit with TLS.
• Passwords are hashed with a modern algorithm and never stored in a readable form.
• Invitation and password-reset tokens are stored hashed, are single use, and expire.
• Your ClickUp API key is encrypted at rest.
• Database storage and backups are encrypted at rest by AWS.

Access control

• Role-based permissions, from portal end users through to platform administrators.
• Every permission decision runs through a single authorisation layer, so there is one place to audit rather than checks scattered through the code.
• Session cookies are HTTP-only and marked secure; the long-lived “remember me” cookie is scoped to a single host so it cannot be replayed across portals.
• Staff access to production is limited to those who need it to operate the service.

Infrastructure

• Hosted on AWS in ap-southeast-2 (Sydney), on managed container infrastructure.
• Infrastructure is defined as code and version-controlled, so changes are reviewable.
• Automated managed database backups.
• Errors and performance monitored continuously.

Development practices

• Every change goes through pull-request review before reaching production.
• An automated suite of over two thousand tests runs on every change, including tenant-isolation tests for each feature.
• Static analysis and coding-standard checks are enforced in the pipeline, not left to reviewers.
• Dependencies are monitored for published vulnerabilities.

Sub-processors

Each of these receives only what it needs to do its job. We update this list before adding a new one.

Outbound email may be sent via Resend instead of SendGrid on some accounts; both are used for the same purpose and see the same data.

Reporting a vulnerability

If you believe you have found a security issue, email hello@cliqdesk.app with enough detail to reproduce it. We will acknowledge within two business days and keep you updated until it is resolved. Please give us a reasonable chance to fix it before disclosing it publicly, and do not access or modify data that is not yours while investigating.

Data breach notification

If a breach occurs that is likely to result in serious harm, we will notify affected customers and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

What we do not currently have

Stated plainly, because a security page that only lists strengths is not much use:

• We do not hold SOC 2 or ISO 27001 certification.
• We do not offer a contractual uptime SLA on standard plans.
• We do not currently offer single sign-on or SCIM provisioning.

If any of these is a requirement for you, get in touch — it helps us prioritise.