The controls we run, and how we check them
Each control below is traced to SE Desk’s code or a live setting. This page lists the ones that pass today.
SE Desk is not SOC 2 or ISO 27001 certified yet. The tags show which part of each standard a control covers.
9 controls
Last checked
- In the product
- 5
- On this website
- 4
In the product
How SE Desk reads, stores and protects client email and calendar data.
Read only access to Gmail and Calendar
SE Desk asks Google only for read only access. It can’t send, change or delete an email or an event.
How we check: The Google access the app asks for, in its code. Checked .
- SOC 2 CC6.1
- ISO 27001 A.5.15
- GDPR Art 25
Google tokens are encrypted
The token that lets SE Desk read your mail is stored encrypted, with AES 256 GCM.
How we check: The app’s encryption code. Checked .
- SOC 2 CC6.1
- ISO 27001 A.8.24
- GDPR Art 32
Records are private to their owner
The database itself keeps each person’s records private, on every table, not just the app. Tests cover it.
How we check: Row security in the live database, and the app’s database tests. Checked .
- SOC 2 CC6.1
- ISO 27001 A.8.3
- GDPR Art 32
Disconnect cancels access
Disconnect Google and SE Desk’s access is cancelled. It stops reading straight away.
How we check: The disconnect step in the app’s code. Checked .
- SOC 2 CC6.2
- ISO 27001 A.5.18
- GDPR Art 7
Reads only what it needs
Tasks come from the last 30 days of email, or 60 for a reply you owe. History goes back no more than 180 days. Emails used to spot templates aren’t stored.
How we check: Time limits and what gets saved, in the app’s code. Checked .
- SOC 2 P3.1
- ISO 27001 A.5.34
- GDPR Art 5(1)(c)
On this website
se-desk.com and the early access list.
The signup list can’t be read from the website
The website can add a signup but never read the list back. Only the SE Desk team can read it.
How we check: Access rules on the live signup table. Checked .
- SOC 2 CC6.1
- ISO 27001 A.5.15
- GDPR Art 32
HTTPS and browser protections
This site is served over HTTPS, and tells browsers not to show it inside other sites, not to guess file types, and not to pass full page addresses to other sites.
How we check: The site’s hosting settings. Checked .
- SOC 2 CC6.7
- ISO 27001 A.8.9
- GDPR Art 32
You’re told how your details are used
The early access form says what your details are used for, and links our privacy notice.
How we check: The form and the privacy notice on this site. Checked .
- SOC 2 P1.1
- ISO 27001 A.5.34
- GDPR Art 13
No tracking
This website loads no analytics, advertising or tracking scripts, and sets no tracking cookies.
How we check: The site’s source code. Checked .
- SOC 2 P3.1
- ISO 27001 A.5.34
- GDPR Art 5(1)(c)
Who else touches your data
| Cloud hosting | Runs the app and this website |
|---|---|
| Managed database | Stores your records, with access rules on every row |
| AI model provider | Reads the client emails you pick to propose updates, and doesn’t train on them |
| Email delivery | Sends sign in codes for the app, and tells our team when you send an enquiry |
| Gmail and Calendar, read only, only if you connect them |
Full list of providers and where they’re based, on request: hello@se-desk.com
How this page works
Plain rules, so you know what a tick here means.
- Traced to the source
- A control is listed only once we’ve confirmed it in the code or a live setting, not from memory.
- Passing only
- If a check fails, the control comes off this page until it’s fixed.
- Checked by hand, for now
- Daily automatic checks are being built. See the roadmap.
- The email rules
- How SE Desk reads client email, step by step, is on the Security page.
Have a security questionnaire? Send it to hello@se-desk.com and we’ll answer it in writing.
Get early access
We’re opening SE Desk to a small number of SE teams first. Tell us about yours and we’ll be in touch when there’s a place.
- Set up with you, around how your team already runs POCs
- Early access pricing
- A direct line to the people building it