Encryption
All data stored in Desk FT is encrypted at rest using AES-256. All data in transit between your device and our servers is encrypted over HTTPS (TLS). Uploaded files are kept in encrypted object storage and handed out only through short-lived signed links, after we check that the person asking belongs to that desk.
Infrastructure
The database runs on Supabase (AWS, us-west-2, Oregon, USA). Uploaded files are stored on Cloudflare R2. Row-level security rules in the database decide who can read and change each row, so each business can only reach its own workspaces, desks and client data, whichever app or API asks.
Authentication
Passwords are hashed using bcrypt. We support Sign in with Apple and Sign in with Google as passwordless alternatives. Sessions use short-lived JWT access tokens with automatic refresh. Invites are single-use links that expire after 7 days.
Data isolation
Every workspace is fully isolated. A client invited to one desk can only see that desk — not other desks in the same workspace, not other workspaces. One business can never see another business's workspaces.
We don't train on your data
Your files, forms, timelines, and checklist items are never used to train AI models — ours or anyone else's. This is a hard commitment, not a preference setting.
Who controls the data
We honour access, export and deletion requests. You're the data controller for the content in your workspaces; we act as your processor (and are the controller only for account & platform data). See the Privacy Policy for who to ask for what.
Export & delete your data
Ask us for a copy of your workspace data and we'll send it in a portable format. Deleting your account (in the app, under Settings) removes the workspaces you own and your account data — live data within 30 days, encrypted backups rolling off within 90. Content you added to someone else's workspace is de-identified and kept by that owner, who controls it.
No third-party data selling
We don't sell, rent, or share your data with third parties for advertising or analytics purposes. The services that process data for us (Supabase, Cloudflare, Resend, Google Firebase, Apple, RevenueCat and Stripe) and exactly what each one sees are listed in our Privacy Policy.