Security at Deske.
Deske handles call audio, transcripts, and patient or client contact information for the businesses we serve. We take that responsibility seriously — and we’re straightforward about what we do today versus what we’re still working toward.
Encryption isn’t a feature — it’s a floor. The rest of this page is what’s between the floor and a security program we’re proud to compare to anyone’s.
What we do today
The baseline, in plain language. Everything below is in production today.
- Encryption in transit (TLS) for all traffic between users, the Deske app, and our infrastructure.
- Encryption at rest for stored data using industry-standard AES-256 via our database provider.
- Passwordless email-code authentication — no passwords stored, codes expire after a short window.
- Per-tenant isolation so one business’s data is never visible to another. Membership-scoped queries on every read.
- Audit logging for admin-level changes (team invites, role changes, billing edits).
- Daily backups with point-in-time recovery; backups are encrypted at rest.
A short, honest note on HIPAA
Deske is not a HIPAA-covered entity and we do not currently sign BAAs. The platform is built for scheduling and front-office workflows — not clinical detail. Don’t send protected health information through Deske. See our HIPAA & BAA status page for the longer version.
What we’re working toward
Real work-in-progress items, not certifications we already hold.
- Formal incident response and breach notification procedures.
- Third-party penetration test engagement before public launch.
- A SOC 2 Type II audit, when a larger practice or an enterprise customer needs one.
We do not currently hold SOC 2, sign BAAs, or claim HIPAA compliance. We will say so on the day we do.
Reporting a security issue
If you’ve found a vulnerability, please email security@deske.ai. We’ll respond within two business days. We don’t run a public bounty program yet — when we do, we’ll publish a scope and a payout grid. Until then, we’ll thank you in the release notes and, if you’d like, coordinate disclosure on your timeline.