Trust centre
Built for organisations that answer to auditors
What we do to keep VektaDesk available and your data safe, and the controls you get to meet your own policies.
99.92%
uptime, last 7 days
99.94%
uptime, last 30 days
Daily
backups, 14 kept
Uptime is measured by our own checks of the service every minute.
Signing in
- Sign in with Microsoft 365: your MFA and Conditional Access rules apply, and VektaDesk never sees Microsoft passwords
- Single sign-on with Okta, Google or any OIDC provider, and SCIM to create and remove accounts automatically (Enterprise)
- Two-step sign-in with authenticator apps (Microsoft Authenticator, Google Authenticator, Duo Mobile) for password accounts, required per organisation
- "Microsoft sign-in only" policy, with a protected emergency login for the head of IT
- Automatic sign-out after inactivity, and a maximum session length you choose
- Network restriction: allow VektaDesk only from your offices and VPN
Access control
- Built-in roles for requesters, agents, team leads, IT admins and the head of IT
- Custom roles: decide exactly which administration areas each person can use
- IT providers only get into your desk when you allow it, for as long as you choose, and every action is audited
- Leavers lose access as soon as their Microsoft 365 account is disabled
Audit and accountability
- Every sign-in, failed sign-in, role and permission change, setting change and export is recorded with who, when and what
- Audit log export for your auditors (Enterprise)
- API keys are stored only as a fingerprint, can be limited to read, write or approvals, and revoked instantly
Protecting data
- All traffic is encrypted in transit (HTTPS/TLS)
- Each organisation's data is kept separate, and every request is checked against the signed-in person's organisation
- Webhooks are signed (HMAC-SHA256) so your systems can verify they came from VektaDesk, and never go to private network addresses
- We never sell your data or use it for anything other than running your service desk
Vekta AI
- Optional, and switched on by each organisation
- Your ticket data isn't used to train AI models
- Self-help answers are written only from your own help articles
- Every AI action is counted per organisation, with a monthly limit
Your data, your rules
- Data retention: automatically anonymise or delete closed tickets after the period you choose, to meet privacy laws such as the Kenya Data Protection Act or GDPR
- Export your tickets, people and audit trail as CSV at any time: no lock-in
- Removed people are hidden everywhere and never re-added by the Microsoft 365 sync
Availability and backups
- The service is checked every minute, around the clock
- The database is backed up every day, and the 14 most recent backups are kept
- A public status page for each customer, with uptime monitors for your own services
For your procurement and security review
- We'll complete your security questionnaire.
- Data processing agreement on request.
- Ask us where your data is hosted, or if it must stay in a particular country.
- The Microsoft 365 permissions VektaDesk uses are listed for your admin before they approve them.
- Report a security concern: we respond within one business day.
See VektaDesk with your own setup
A 30-minute call with our team, set up the way your IT department works. If it fits, your trial can start the same day.