Security and data protection
Authentication, sessions, audit and how tenant data is isolated.
Overview
How sign-in, data isolation and accountability work in KitoDesk.
Authentication
- Email and password, organisation-scoped at
yourcompany.kitodesk.com. - MFA - authenticator codes can be required per workspace.
- Workspace SSO (Google Workspace and enterprise SSO) is configured in Settings → Security.
Tenant isolation
Every query is scoped to your tenant ID, enforced in the application and again by Postgres row-level security. Cross-tenant access is covered by automated tests for every shared entity.
Encryption and secrets
Provider credentials and integration secrets are stored AES-256-GCM encrypted and never appear in exports or logs.
Audit trail
Sign-ins, permission changes, assignments, deletions, recording plays, transcript reads, exports and automation runs go to an append-only audit log visible to admins.
Recordings and transcripts
Stored with the provider and streamed through the API. Access requires the recordings permission, every access is audited, and a retention policy deletes them after a configured number of days.