What PimiDesk protects, and what it does not have yet
PimiDesk is an email helpdesk, so it holds your customers' mail. This page says where that mail lives, who can reach it, and what is still missing.
14-day trial. Card needed, cancel anytime.
Mail and files stay on Amazon, encrypted and backed up
Mail comes in and goes out through Amazon SES in us-east-1. On your own domain, outgoing mail is signed with your domain's own DKIM keys.
Files
Attachments are kept in Amazon S3 in us-east-1, encrypted at rest. The storage is not public.
Backups
The database is backed up every night. The newest 14 backups are kept, and a failed backup alerts us.
Every key opens only what you gave it
- API tokens have a scope. Read, drafts only, or read and write. A token is replaced in one call when you want a new one.
- AI connections have the same three levels. Each connected app is listed with its workspaces and can be disconnected. Changing your password ends every one of them.
- Workspaces are separate. A member sees only the workspaces they belong to. Members, domains, webhooks and permanent deletes are for owners.
- Webhooks are signed. Each delivery carries an HMAC-SHA256 signature made with that webhook’s own secret, so your server can check it came from us.
- Card details never reach us. Paddle takes the payment as merchant of record.
The drafts-only level is made for an AI assistant: it can prepare a reply and never send one. How the AI connection works.
Mail has to prove who sent it
Every message is checked.
The SPF, DKIM and DMARC results are stored with the message. A sender that could not be verified is marked in the thread.
Failing mail is held.
Mail that fails the sender’s own DMARC policy, or is flagged for a virus, never becomes a ticket.
Reply threading is signed.
Outgoing mail carries a signed thread marker, and a reply is matched to its thread by it.
You delete your own data, without asking us
Trash
A deleted ticket or conversation sits in the trash for 30 days. Then it is removed for good, files included. Nightly backups age out after that.
A workspace
An owner can delete a workspace. Its files are removed with it.
Your account
You can delete your account yourself, with your password. There is no form to send and nobody to ask.
What we do not have yet
- No two-factor login. Sign-in is an email address and a password.
- No single sign-on. No SAML or other single sign-on.
- No export file. There is no download button for your data. The API can read all of it: tickets, messages, contacts and files.
- No public status page. There is no uptime page to check yet.
- No certifications. No SOC 2 and no ISO 27001. If you need one of them today, PimiDesk is not the right pick yet.
Need something on this list before you can use PimiDesk? Write to [email protected]. The rest of the terms are in the privacy policy, and the plans are on the pricing page.