We can't leak it. We never held it.
Most support tools ask you to move your ticket history into their cloud. HavnDesk is built the other way around: your database, your buckets and your mail account stay yours, and the only thing we run is the desk your team signs into.
The record is in your cluster
Tickets, comments, tags, forms and articles are documents in a database you own. HavnDesk does not mirror them into a second one, so there is no copy of your support history on our side to leak.
Attachments are in your bucket
Five-minute presigned URLs mean content goes customer to bucket to agent. What HavnDesk keeps is a file name, a type, a size and an object key — and nothing else.
Mail moves through your account
Your Postmark server, your sender signature, your delivery logs. HavnDesk's own Postmark is used for login codes and invitations, and never for your customers' mail.
Secrets are stored to be unread
API keys, session tokens, login codes and invite codes are one-way hashes. The two exceptions are your Postmark token and ticket variable values, which exist to be used and rendered — so those are encrypted with AES-256-GCM under a deployment key, write-only through the API, and rotatable without anyone re-entering them.
The host never decides anything
Host, Origin and Referer are never inputs to an authorization decision. They appear in CORS and in the widget's origin allowlist, and both can only narrow access. A DNS or proxy mistake cannot hand anyone a session.
Every query is scoped to one organization
Membership and role are checked by middleware on every request, and cross-organization isolation is asserted in the test suite — including revoked keys, replay windows and cross-tenant reads.
Credentials, and what each one costs you
Every credential in the system, what it can do, and what happens if it ends up somewhere it shouldn't. The interesting row is the signing secret: it is what makes a leaked API key survivable, because a key alone stops being enough on its own.
| Credential | What it can do | Can it leak? | If it does |
|---|---|---|---|
| Session token | One user | Possible via XSS on the web build | That user's access until logout or expiry |
| hd_k_… (tickets:write) | Create tickets only | Possible if stored client-side | Spam in your inbox — unless signing is on |
| hd_k_… (tickets:widget) | Create tickets, origin-checked | Deliberate, the key is public | Bounded by your origin allowlist |
| whsec_… signing secret | Signs submissions | Must never reach a browser | A third party could submit as you |
| Inbound webhook token | One organization's inbound route | Only that route and the admin screen | Someone could file fake tickets there |
The trade, said plainly
Because your data lives in your accounts, HavnDesk is not your backup and not your data processor. If a cluster is lost, restoring it is your provider's snapshot and your restore plan — we can't reach in and bring it back. That is the deal that buys the isolation, and we would rather you hear it here than discover it on a bad day.