Security and trust
Your work, under your control.
SecondDesk is built so automation can't outrun your judgment. The rules below are enforced in code, not left to settings.
- Never sends, pays, submits or deletes on its own.
- Never enters credentials.
- Never speaks or types for you in meetings.
- Never batch-approves clients, execs, HR or outside recipients.
- Red-lane items never get action buttons.
What it never does.
Never sends, pays, submits or deletes on its own.
Never enters credentials.
Never speaks or types for you in meetings.
Never batch-approves clients, execs, HR or outside recipients.
Red-lane items never get action buttons.
Lane ceilings can only be tightened.
Delegates never send; drafts go to you.
- unit tests
- 4,664 unit tests
- guard the lane engine
- 463 guard the lane engine
- releases this month
- 16 releases this month
Counted from the repository at build time. See the changelog
The lane engine
Every action has a natural lane. Your ceilings, your workspace's caps and the sensitivity of the people involved can only move it toward stricter. The stricter lane wins.
1. An action
Reply, move, pay, send…
Starts in its natural lane.
2. Can only get stricter
- Your ceiling
- Workspace caps
- Who is involved
Green can become Yellow or Red. Never the other way.
3. The stricter lane wins
Runs on its own
Reversible, stays in your account, always logged with Undo.
Drafted, then you approve
Parked in one Review queue. Nothing leaves without your approval: per item, or under a standing approval you set.
Never automated
Prep and an alert. No action buttons, ever.
SecondDesk will: Draft it and park it in Review. Nothing goes out until you approve.
Why: Client domain (acme.com). Sensitive items always go to Review.
Batch approve: never
This check runs the same lane engine as the app. Lane rules are enforced in code and covered by 463 tests.
Autopilot limits.
Autopilot runs routine work in the background. These limits hold whatever its posture is.
Silence never expands what it may do. A timeout never sends, approves or decides anything.
Sensitive items are never batched, bundled or covered by a rule.
Promises stay with you. New dates, prices or scope always need you.
Incoming messages can't change your rules.
It never sends, pays, deletes or enters credentials on its own.
Controls for the whole workspace.
AI policy and the policy simulator
See an action's lane before you edit a rule.
See it in the Admin demoWorkspace lane caps
Cap any module for everyone. Individuals can tighten further, never loosen.
See it in the Admin demoAudit log with before and after
Each change is logged with its old and new value.
See it in the Admin demoRetention by data type
Choose how long each kind of data is kept.
See it in the Admin demoSSO and 2FA enforcement
Require strong sign-in for everyone.
See it in the Admin demoDevice pairing, remote access
Pair PCs by code; approve remote sessions.
See it in the Admin demo
No passwords to leak.
Passkeys (phishing-resistant, stored on your device) and one-time email links that expire in 15 minutes. No passwords.
Data commitments.
Encrypted in transit and at rest.
Your work is not used to train models.
You can export and delete your data.
Third parties
Subprocessors.
The services that handle data on our behalf.
| Subprocessor | What it does | Location |
|---|---|---|
| Vercel | Hosting, logs, privacy-friendly analytics | United States |
| Supabase | Accounts, passkeys and sign-in sessions | United States |
| Resend | Sign-in email, when enabled | United States |
Responsible disclosure
Found something? Tell us.
Use the security form and include the steps to reproduce it and the page or API involved. Please don't access other people's data or run tests that degrade the service. We'll acknowledge your report within one business day.
Questions
Security, answered.
Can an automation ever send something without my approval?
No. Anything that leaves your account is a Yellow-lane draft that waits in Review. Ceilings can only be tightened, never raised past the lane rules.
What can admins see?
Admins set policy, lane caps and retention and read the audit log of changes. They don't read your drafts or your mail from the console.
How does sign-in work?
Passkeys, which are phishing-resistant and stored on your device, or one-time email links that expire in 15 minutes. There are no passwords.
How do I report a vulnerability?
Use the security form on the contact page. We'll acknowledge it within one business day.
Talk to us, or try the Admin demo.
Walk through the controls yourself, or ask for a security review.
Free during early accessThe demo needs no sign-up