Supdesk
Start free trial

Security

Security is part of the product contract.

Not an add-on. These invariants are documented in ARCHITECTURE.md and covered by automated tests in the API.

  1. 01

    Identity tokens

    End-user access starts with HS256 JWTs signed by your backend using the tenant identity secret. Supdesk exchanges them for session tokens scoped to a single end user and tenant. Anonymous sessions cannot invoke connector tools or refunds.

    Read the spec
  2. 02

    Signed connector calls

    Every server-to-server request includes X-Supportal-Signature with a timestamp and HMAC-SHA256 over the raw body. Your backend must reject stale or invalid signatures. The user id in each payload always comes from the verified session, never from model-generated arguments.

    Read the spec
  3. 03

    Server-side refund policy

    Refund amounts, rolling per-user limits, dry-run eligibility, human approval thresholds, and user confirmation are enforced in the API regardless of model output. Connector responses are treated as untrusted in prompts.

    Read the spec
  4. 04

    Data isolation

    Conversations, articles, embeddings, and audit events are keyed by tenant id. Retrieval filters Vectorize and FTS by tenant. Admin APIs resolve tenant from the session cookie, not the public hostname.