Privacy isn't a checkbox. It's the default.
Many help desks add compliance once sales asks for it. At Deskwoot it comes with every plan: the app and its database run in the EU, and the Data Processing Agreement is written and ready to accept.
Your data lives in the EU on every plan
The app and its database run on servers in the Netherlands for every workspace, the free plan included. Where your data lives never depends on what you pay.
Hosted in the EU
Encrypted in transit
Credentials sealed with AES-256
Paperwork ready before you pay
Procurement tends to ask for the same documents. They are written already, and you can accept the DPA yourself without emailing anyone.
DPA under GDPR Art. 28
Security measures in writing
Records and breach notice
“We handle our users' trading data, so EU hosting and “your AI never trains on our data” aren't nice-to-haves, they're mandatory. Deskwoot had both from day one, DPA included. That it's also cheaper than the big US tools made it the easiest software call of the year.”Customer Operations, Trade Reclaim
Your customers' data, under your control
When someone asks what you hold about them, or wants it deleted, your team handles it from one page in the settings, without waiting for us.
Export on request
Erasure with a preview
30 days to change your mind
Every vendor named, every change announced
Annex B of the DPA lists each sub-processor with its purpose and region, from hosting and AI to email delivery and payments.
A public list
Notice before changes
Safeguards for transfers
The smaller details procurement checks
The details security reviews ask about, answered up front.
No AI training on your data
Conversation content sent to our AI provider Anthropic is used to answer, not to train its models. Our DPA and Anthropic's DPA confirm it in writing.IP addresses masked after 30 days
IP addresses stored in audit logs and visitor data are cut down to the network part once they are 30 days old.Two factor authentication
Anyone on your team can protect their login with an authenticator app. On Enterprise, admins can require it for everyone.Audit log
Sign ins, API token changes, plan changes and deletions are recorded with user, time and IP address.Roles and permissions
Owners, admins and agents get different rights. On Enterprise you can build custom roles with exactly the permissions you choose.Consent where the law asks
Visitors from the EU, EEA, UK and Switzerland get a cookie banner on our website that asks for statistics and marketing separately, and no tracking loads before they choose. Our newsletter only starts after you confirm your address.
Procurement and GDPR questions
The short answers are here. For anything else, ask Fynn below.
Is Deskwoot GDPR compliant?
Yes. Your workspace data is hosted in the EU, every workspace can accept a Data Processing Agreement under Art. 28, we keep records of processing under Art. 30, and your team can export or erase a person's data from the settings whenever someone asks.
Where is my customer data stored?
The app and its database run in the EU (Netherlands) on every plan, the free plan included. A few vendors outside the EEA, such as email delivery and SMS, receive only what they need for their task. Annex B of the DPA lists each one with its region.
How do I sign the Data Processing Agreement (DPA)?
You don't need to email anyone. Read the DPA on our website, accept it in your workspace settings, and the PDF arrives by email. Annex A of the same document lists our technical and organisational measures under Art. 32.
How do we delete a customer's data when they ask?
Open the data requests page in your settings, find the contact by email and start an erasure. Deskwoot shows what will be deleted, you confirm by typing the address again, and the data is erased right away. That covers the right to erasure under GDPR Art. 17.
Does Deskwoot use my data to train AI models?
No. Conversation content goes to our AI provider Anthropic only to generate replies, and it is not used to train its models. Voice messages from WhatsApp and Telegram go to AssemblyAI, which turns them into text on its servers in the EU and does not use them for training either. Our DPA and Anthropic's DPA confirm this in writing. Fynn answers from your help center and the sources you add in the Training Hub, scoped to your workspace.
Who are Deskwoot's sub-processors?
Annex B of the DPA names every sub-processor with its purpose and region. We tell you before a new one is added or replaced, so you can object first. Vendors outside the EEA are covered by the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.
What happens to my data if I close my Deskwoot account?
Deleting your workspace starts a grace period of 30 days, in case you change your mind or still want to export. On a paid plan, the 30 days start when your current billing period ends. After that, conversations, messages, contacts and files are deleted for good.
Is my data encrypted at rest and in transit?
In transit, yes: every connection is encrypted with TLS, the dashboard, the chat widget and the API with TLS 1.2 or newer. At rest, credentials you store with us, such as mail passwords, API keys, integration tokens and 2FA secrets, are encrypted field by field with AES-256-GCM, and login passwords are kept only as bcrypt hashes. Messages and contacts are not encrypted field by field.
