Data protection in Cliedesk Pro

This is part of Cliedesk Pro. Admins set it up in Settings → Security → Data protection. You need the Manage security permission (the Owner has it).

Read-access log

Turn on Log who opens conversations, contacts, exports and protected fields and select Save. From then on, Cliedesk writes one entry when someone opens a conversation or a contact (also its messages, history or timeline), reads protected fields, or exports data (also a single transcript download). Opening the same record again within 10 minutes writes no new entry. Every export is logged. Reads through the Public API are logged too.

The log is off by default because it can grow fast. Entries are kept 90 days. Change Keep entries for (days) (7 to 730). Nobody can change or delete an entry.

To read the log, open Settings → Security → Read-access log. You need the permission to read the audit log (Owner and Admins by default). You see only entries of your products. Filter by customer (contact id), record and dates. Select Older entries to load more, and Export CSV to download the list. The export itself is written to the audit log.

When a customer’s data is erased, their entries stay, but they no longer name the customer.

Protected fields

Protected fields hold values such as an ID number, an insurance number or a diagnosis. Cliedesk stores them encrypted, never as plain text.

1. Select Add field. Give a Label and a Key, choose Contact or Conversation and the Kind of value (text, email or phone).
2. Turn on Exact search if people must find records by this value. Cliedesk then keeps a blind index: a keyed fingerprint of the value that matches only the same value.
3. Select Save fields, then turn on Protected fields can be filled in and select Save.

People who may see personal data (See personal data) select Show protected fields in the customer panel of a conversation. Each read is written to the read-access log. People who may edit contacts or conversation fields can change the values there. Removing a field deletes its values.

The key. Add a dedicated key to wp-config.php: define( 'CLIEDESK_FIELD_ENCRYPTION_KEY', '…' ); (base64 of 32 random bytes). Without it, Cliedesk derives a key from the site encryption key. The screen shows only a fingerprint of the key, never the key.

When there is no CLIEDESK_FIELD_ENCRYPTION_KEY and no CLIEDESK_ENCRYPTION_KEY, the key comes from the WordPress salts. If the salts change (some security plugins change them), protected values can no longer be read. So Cliedesk does not turn on protected fields with this key, and strict mode does not turn them on either. To use it anyway, select I accept that protected values are lost when the WordPress salts change. Protected fields that are on already stay on.

To move to a safe key:

1. Make a key, for example with openssl rand -base64 32.
2. Add define( 'CLIEDESK_FIELD_ENCRYPTION_KEY', '…' ); to wp-config.php.
3. Open this screen and select Re-encrypt now. Wait until no values use an older key. To change the key, put the old value in CLIEDESK_FIELD_ENCRYPTION_KEY_PREVIOUS and the new value in CLIEDESK_FIELD_ENCRYPTION_KEY. Cliedesk re-encrypts every value in the background; you can also select Re-encrypt now. Reading and searching keep working while it runs. Remove the old key when the screen no longer shows values with an older key. Keep a copy of the key with your backups: without it, protected values cannot be read.

While Protected fields can be filled in is on, contact and organization notes are encrypted too. Notes written before are encrypted in the background, and they go back to plain text when you turn the switch off. The email addresses and phone numbers of contacts are not encrypted.

Personal data found by AI

Cliedesk finds card numbers, IBANs and other patterns without AI (see Security and privacy). With AI checks new customer messages for personal data that patterns cannot find on, AI also looks for ID numbers, health information, addresses, birth dates and bank accounts. For each kind, choose Remove from the message, Show masked in messages or Do nothing. To check older messages, choose a period and select Check now. Show masked in messages hides the text only where messages are read. Search, inbox previews, notifications, webhooks and other AI features still see it, and the check runs a few seconds after the message arrives. Only Remove from the message removes the text everywhere. This needs a connected AI provider.

Malware scanning and private storage

• Cloud scanner: if your server has no ClamAV, choose Cloudmersive or Another scanning service (HTTPS) and save the Scanner key. When the scanner cannot answer, the file is labelled “Not scanned”.
• Private storage: turn on Copy stored files to a private S3-compatible bucket, enter the endpoint, region, bucket and keys, and select Test the bucket. New files are copied at once and older ones every few minutes. Files are never public. Exports (data and transcript exports) are not copied. A copy is deleted from the bucket when Cliedesk deletes the file, when its conversation is deleted, when the customer is erased or the file is quarantined.
• Keep files only in the bucket: Cliedesk then removes its own copy of a file, but only after it has read the file back from the bucket and checked that it is the same. People and emails still get the file as before. If the bucket cannot be reached, nothing is lost: files not checked yet keep their copy on your site, and a download shows “The file storage cannot be reached right now” until the bucket answers again. Turn the switch off to bring the files back to your site. Files stay readable when the Pro licence ends. Turn the switch off before you deactivate or remove Cliedesk Pro: without Pro, Cliedesk cannot read files from the bucket, and the plugins screen warns you. Emails in the email test mode (all emails sent to a test address) cannot attach files that are only in the bucket.

Keys are saved encrypted and are never shown again.

Strict mode

When strict mode is on (Settings → Security), Cliedesk Pro also masks every kind of personal data before AI calls, sends AI tasks only to local models, and keeps the read-access log and protected fields on. These switches come back to your own values when strict mode is off. While strict mode is on, you cannot keep the read-access log for fewer days, and you cannot change the bucket or the scanner service.

To save data protection settings, you must have signed in recently or confirm your password.

Audit log in the Public API

An API key with the audit:read scope can list the audit log, check it, and read the read-access log. Tick the scope on purpose: the Read only preset does not include it. A key limited to some products cannot read these logs. See API keys.

What field encryption does not cover

Field encryption protects the contact and conversation fields you mark as protected, and the text of notes. Customer email addresses and phone numbers are not encrypted. Cliedesk needs them in readable form to send email, to match incoming mail to the right customer and to sign customers in to the chat widget. They are protected by access rights, masking and the read-access log instead.