Built to protect your data
This page describes how Deskivo works today. We don't claim certifications we don't hold.
Where your data lives
Your data is hosted on servers based in the UK. Each workspace is pinned to its region.
Tenant isolation
Each organisation's records are separated with PostgreSQL row-level security, enforced by the database on every query.
SSO and two-factor
Microsoft Entra ID sign-in, authenticator-app two-factor for passwords, and a monitored break-glass account for emergencies.
Least privilege
Role-based access with permissions scoped to each site. Portal users see only their own requests and loans.
Encrypted secrets
Client secrets, SMTP passwords and API keys are encrypted at rest and write-only in the interface. Connections use HTTPS.
Audit logging
Sign-ins, settings changes and data changes are logged, with retention from 30 days to seven years by package.
Consent-based support
Deskivo staff can only view your workspace after you approve it. Access is time-limited and recorded in your audit log.
Web protections
CSRF protection, rate limiting, configurable session lifetimes and a strict policy for uploaded images.
Security alerts
Owners are emailed about sensitive events, even when other email is paused.
Data protection
Organisations using Deskivo are the data controllers for the personal data they store in it, and Deskivo processes it on their behalf. Our privacy notice has the details.
For a data processing agreement or a security questionnaire, get in touch.
Reporting a vulnerability
If you think you've found a security issue, contact us through the contact page with "Security" in the subject.
Be first in when we open.
Join the Deskivo UK launch list. Your data is hosted on servers based in the UK.