Security
How we keep your helpdesk safe
Your helpdesk holds your people’s names, their problems, and sometimes things that should stay private. Here’s what we do about that, in plain words.
Your own helpdesk, not a shared one
- Every customer gets their own database, with its own database login, and their own folder for files.
- Each helpdesk runs as its own user on the server, so one can’t read another’s files.
- Your address (yourorg.requestcrew.com) is yours alone.
Signing in
- Sign in with Microsoft 365, Google, Okta, AD FS or another OpenID Connect provider, or your Windows network. Your own sign-in rules, like two-step sign-in, still apply.
- Helpdesk passwords are stored as one-way hashes, never as plain text. You can require a code from an authenticator app for everyone who uses one.
- Too many wrong tries means a 15-minute wait, and it doesn’t give away which usernames are real.
- A locked-away emergency account, with its own authenticator code, for the day sign-in breaks.
- When someone leaves and their account is turned off in Active Directory, Microsoft 365, or Google Workspace, the helpdesk can turn them off within the hour, with an email to your admins saying who and why.
- Staying signed in is off unless you turn it on, and the box for it starts unticked every time. Anyone can sign themselves out on every computer and phone at once, and IT can do it for them.
Who sees what
- Roles decide what each person can do, down to who can change sign-in and system settings.
- Internal notes stay between techs. Requesters never see them.
- An audit log records who changed settings, roles, and people.
- Ticket history is never rewritten. Closed tickets follow your records retention schedule, legal holds included.
Encrypted, coming and going
- Every page and every connection uses HTTPS, with certificates that renew on their own.
- Passwords and keys for things you connect (your mailbox, chat, AI) are encrypted where they’re saved.
- Backups are encrypted before they leave the server.
Backups you can count on
- Every helpdesk is backed up every night, and its database every 15 minutes, so it can go back to any moment in the last week. The last 14 nights stay on the server.
- Encrypted copies go off-site to Backblaze every 15 minutes, locked so they can’t be deleted early, even by someone who got into the server. Nightly copies are kept 30 days.
- A backup that fails is reported, and older ones stay until a good one is made.
Servers we keep up
- A firewall that lets in web traffic and our own secure sign-in, and nothing else.
- Security updates install automatically.
- The servers check themselves every 15 minutes and tell us when something needs a look: a helpdesk down, a backup that didn’t run, a disk filling up, a certificate about to run out.
Questions people ask
Who can get into our helpdesk’s data?
Your people, with the roles you give them. On our side, only RequestCrew can reach the servers, and we only look at your data to run your helpdesk, to fix something or help when you ask, to keep it secure, or when the law requires it. Our Privacy Policy has the details.
Where is our data kept?
In the United States. Your helpdesk runs on our server in Boston, Massachusetts. The encrypted off-site backups are at Backblaze in its US East region, and if you use the built-in email, messages pass through Amazon Web Services in Ohio. None of it is kept outside the US. Services you connect yourself, like your own Microsoft 365 or AI account, keep data wherever your agreement with them says.
What does the inventory add-on reach on our network?
Only what you set up. The on-site agent scans the private address ranges your Super Admins give it, reading what devices share on their own, like a printer’s model and serial number, and sends what it finds to your helpdesk over its own outgoing connection. The optional deep scan reads each Windows PC’s serial number, memory, storage, operating system, and who’s signed in, with an account you give it on the agent’s computer, where the password stays encrypted and never reaches us. Microsoft Intune and Google Workspace are read-only. It’s all off until you turn it on.
Does AI read our tickets?
Not unless you turn it on. AI help is off in every helpdesk to start with. If you turn it on, it uses your own Claude or Azure OpenAI account, under your agreement with them, and only sends what that setting allows.
Who else handles our information?
A short list of companies that help us run RequestCrew: Hostinger (our servers), Backblaze (off-site backups, which they can’t read), Amazon Web Services (your helpdesk’s built-in email, if you use it), Google Workspace (our own email), Stripe (payments; we never see full card or bank numbers), Cloudflare (the spam check on this website’s forms), and YouTube (the tour video on this website, only when someone presses play). The Privacy Policy says what each one gets.
Can we get our data out?
Any time. Your admins can download everything themselves from Settings: tickets, people, articles, and files, with spreadsheets that open in Excel. Or ask and we’ll send the database itself. If you leave, we keep everything for 30 days in case you change your mind, then remove it. One final backup is kept 30 days after that, and off-site copies age out on the same schedule.
Is the helpdesk accessible?
Yes. It’s built to meet WCAG 2.2 at level AA, which includes WCAG 2.1 AA, the standard state and local governments are held to under the ADA. It works from the keyboard and with screen readers, in light and dark mode, and on a phone. Our Accessibility Conformance Report (VPAT 2.5, WCAG edition) goes through every rule, and each helpdesk has its own accessibility statement linked at the bottom of every page.
Do you have a security questionnaire or a SOC 2 report?
We don’t have a SOC 2 report. We’re happy to fill out your security questionnaire, though, and answer anything this page doesn’t. Write to hello@requestcrew.com.
Found a problem?
If you think you’ve found a security problem in RequestCrew, please write to hello@requestcrew.com with what you found and how to see it. We’ll answer quickly and keep you posted while we fix it. Please don’t test against other customers’ helpdesks; ask us and we’ll set one up for you.
For how things are running right now, see the status page.