This page summarises how we protect and handle customer data in our Zendesk apps. It supplements the Privacy Policy and the Data Processing Addendum, which contain the binding terms.
Where data is hosted
- Application hosting and the managed PostgreSQL database run on Render. The web service runs in Frankfurt (EU Central). The managed database is also in Frankfurt (EU Central).
- Payments for subscriptions are handled by Stripe. Customer Zendesk data stays in the customer's own Zendesk.
- Cloudflare is used in front of the Enhanced Messaging Widget only.
- The full list is in the sub-processor list.
Encryption
- Data is encrypted in transit with TLS.
- OAuth tokens to a customer's Zendesk are encrypted at rest.
- The managed database is encrypted at rest by our hosting provider.
Access control
- Access to the Zendesk Marketing Tool is limited to Zendesk administrators or explicitly allowed users.
- Every database query is scoped to the customer account (tenant isolation).
- Two-factor authentication is enabled on our hosting, payment, source-code and Zendesk partner accounts. Access internally follows least privilege.
Integrity and logging
- Webhooks from Zendesk and Stripe are verified by HMAC signature.
- Unsubscribe links use signed tokens.
- Recipient email addresses are redacted from server logs.
- Notification emails are sent through the customer's own Zendesk from the customer's own support address, so no additional provider is involved, and they never name the contact involved.
Open and click events
For the Zendesk Marketing Tool we process open and click events: for each event we store the time, the link that was clicked and a shortened browser/mail-client identifier (user agent), never the recipient's IP address. Automated events (for example link scanning by corporate mail security systems) are filtered out. The events are kept for the customer's chosen retention period (default 24 months), included in a person's data export, deleted when the person is erased, and deleted with the customer's account.
What we do not store
- Zendesk Marketing Tool: the rendered email content and attachments (they live as tickets in the customer's own Zendesk), the recipient's IP address from opens and clicks, and the customer's full contact database. Contacts are read live from Zendesk at send time; only contacts that were mailed, plus CSV uploads, are kept.
- Enhanced Messaging Widget: Zendesk ticket content is processed transiently and is not stored persistently as a general rule.
Retention and deletion
The customer chooses how long finished send history is kept (1 to 3,650 days, or indefinitely; default 2 years). On expiry it is anonymised (the default; statistics stay) or deleted completely. Work in progress, uploaded contact lists and opt-outs are never expired. A job applies the setting every 6 hours.
Administrators can download everything held for the account at any time as one JSON file (Settings > Privacy & data > "Download everything"). It never includes connection tokens, secrets or our billing records, stays available while sending is paused or a deletion is scheduled, and each export is logged with counts only.
Administrators can delete all of the customer's data in the app (Settings > Delete my data): sending pauses at once, the data is deleted 7 days later (or 7 days after the subscription ends), and it can be cancelled until then. A "delete now" option cancels the subscription without refund and deletes everything at once. Before deleting we tell the notification recipients and remove the webhook and triggers we created in the customer's Zendesk. The deletion runs in one transaction and is verified before it is committed; the audit record contains counts only (no subdomain and no personal data). Not deleted: invoices and payment records in Stripe, campaign tickets and emails in the customer's own Zendesk, and database backups. Manual requests to us are still possible. Details are in Annex II of the DPA.
On the "Privacy & data" page, administrators can look up an email address, see what is held about the person, download it as a JSON file and erase the person. Erasing anonymises the person's sends (address, name, merge values, ticket ID and error text removed; counters stay so statistics stay correct), deletes the rest, and removes the person from notifications. An existing opt-out is kept as the plain email address so that the person is never emailed again. Each export and erasure is logged with counts only.
An administrator can withdraw the acceptance of the Terms and DPA in Settings: all sending stops immediately, nothing is deleted, and the history of who accepted and withdrew and when (Zendesk user ID and time only) is kept.
Backups
The database has a point-in-time recovery window of 3 days, so data deleted by us or by a customer ages out of backups within 3 days. We do not create routine logical exports; if one is created on demand, our hosting provider keeps it for at least 7 days and we delete it when it is no longer needed.
Incident response
We have a documented personal-data-breach procedure (triage, containment, notification). We notify affected customers without undue delay after we become aware, and notify the Swedish authority (IMY) within 72 hours where we are the controller.
Reporting a vulnerability
If you believe you have found a security issue, email info@ibamsolutions.com with the details. We will review the report and get back to you.