Security and your data

The primary database is PostgreSQL on Supabase, hosted in the United States, encrypted at rest with AES-256; files such as logos and PDF reports are in Supabase Storage in the United States; the assistant's short-term memory is in Upstash Redis in the United States. Every table is isolated per business at the database level, so one business can never read another's rows. Provider backups rotate on the provider's schedule — typically up to thirty days — and residual copies age out of them after that.

Businesses on DeskOps are not stored in separate copies of the product. Every record belongs to one business, and the database itself, not only the app, refuses to return another business's records to you. If you belong to more than one business, you switch with the business card at the top of the sidebar on a computer, or the business name at the top of the screen on a phone, and everything on screen changes to that business. Connection credentials are encrypted and are never sent to your browser.

No and no. Your data is not sold, licensed or shared for advertising. What you type to Des, and the documents you attach, go to Anthropic's Claude API for that one request and are not retained by Anthropic for training under its API data policy; DeskOps does not use your business data to train any model either. Voice audio streams to ElevenLabs for speech and is not kept on our servers; the text transcript stays on your account and is purged on a rolling ninety-day schedule.

Connection credentials for Stripe, Square, QuickBooks and your bank are encrypted again before storage. DeskOps’s server uses them for sync and billing; the browser and error logs never receive them. Your Support access switch allows read-only support for 72 hours and lists each view. Every account access is logged. Contractor taxpayer IDs are encrypted: signed-in users, including owners, see only the last four digits. The full number goes only on the filing document the owner produces.

Owner only: turn on “Allow support access” for 72 hours, or turn it off sooner. Support sees your business name, trade, time zone and sign-up date; which connections you have, whether each is working, and when it last synced; how many customers, invoices and payments you have (counts only); the support messages you have sent us. Never: any dollar amount; bank or card details; passwords or connection keys; your personal finances; your customers’ contact details. Support cannot change anything. “See details” lists views in the last 30 days, or says history is unavailable.

Two-step sign-in means someone who gets your email password still cannot open DeskOps: after you sign in, DeskOps asks for a 6-digit code from an authenticator app on your phone. Turn it on by scanning the QR code (or typing the key shown under it), typing the first code your app shows, and saving the ten recovery codes. It is never on until you press Turn on two-step sign-in, it is optional for every person, and each person turns it on for their own sign-in only. DeskOps never sends codes by text message.

Use one of the ten recovery codes you saved when you turned two-step on; each one gets you in once, and two-step stays on so you can add your new phone in Settings. No codes either? Choose Lost your phone? and start email recovery: two-step turns off 72 hours later, and DeskOps emails you and notifies your devices the whole time, so if someone else started it you can sign in with your code and cancel it. After the 72 hours, sign in again and press Turn off two-step and continue.

No. Support has no switch for it, and neither does any DeskOps admin. It turns off only three ways: you, with a current code from your app; you, with one of your recovery codes; or the 72-hour email recovery, which tells you on every channel DeskOps has while it waits. Every change to it is emailed to you. When you turn it on, DeskOps signs out your other phones and computers; sign back in there with your code.

No. Owner finances, Cash forecast, Taxes, Business report, Businesses, Add-ons, Messaging and Settings are owner-only pages; a manager, bookkeeper or technician never sees them, and a link to one bounces them back. Field seats are narrower still: their own jobs, the schedule and Ask Des, with every money page off limits. Des follows the same lines — asked about revenue, pay or taxes, it tells a technician plainly that those are the owner's.

Only what that document is for. A pay link shows the invoice and a way to pay it; a quote link shows the quote and a way to accept or decline; an arrival page shows when the crew is coming; a booking page shows your services and open times. None of them carry your other customers, your numbers, or a way into DeskOps — the link is the whole handshake, there is no sign-in behind it, and a mistyped link shows a plain "not found" page rather than anyone's data.

Type DELETE to close this business, cancel its subscriptions, disconnect integrations where supported, and remove assistant memory and chats. Your sign-in goes too if this is your last business; others stay open. Some records remain for legal and tax obligations (Privacy policy). Des uploads need separate removal or an erasure request. Export first: you cannot undo closure in DeskOps. A confirmation email follows.

Yes. Anyone who gets the link, including someone you forward its email to, can open that invoice or quote without signing in. A signed quote link also lets them download its signed copy. Keep these links private: send them only to people who should see the document, and do not post them publicly.

Payment does not expire an invoice link. A quote's expiry stops new acceptance, but does not disable its signed-copy download. Do not assume paying, signing or forwarding makes a link private again. The link gives access to that document; it does not give access to your DeskOps account or your other customers.

Every change to an invoice is recorded as it happens: what changed, who did it, when, and what the value was before when there was one. An invoice made before this history began says so with the date it began, rather than looking as if nobody ever touched it. If the history cannot be loaded, the page says it could not load it; it never shows an empty list in its place. For the books, a closed month refuses changes to its transactions, expenses and invoices until the owner reopens it with a written reason and a reference. Taxes → Tools → Trial balance exports the balanced journal behind your numbers, and your accountant can also see what changed since the last export from the partner portal.