Skip to content

Black Friday:

60% off

Cliedesk Pro

Every plan, every site count. Ends Cyber Monday.

00 days 00 hrs 00 min 00 sec
Claim 60% off

Security and privacy

Your customers’ data stays in your WordPress database.

Cliedesk is a self-hosted help desk: a WordPress plugin, not a hosted service. Conversations, contacts and files live on your own site, and data leaves it only for the providers you choose to connect — your email provider, your messaging channels, your AI provider.

Get Cliedesk Pro Start free

Data ownership

Your data, on your server

  • All support data is stored in your WordPress database and your site’s storage, wherever you host it.
  • Cliedesk sends nothing to a Cliedesk service: no cloud copy, no relay, no AI credits.
  • Export all data as a ZIP — every table as JSON, conversations and contacts as CSV, and stored files — with or without a Pro licence.
  • Deactivating or deleting the plugin keeps your data. Deleting everything takes a typed confirmation and can wait 14 days, with reminders and a way to cancel.
  • AI runs on your own provider key. You can also keep AI on your own server, with cloud AI switched off.

What goes where

Data leaves your site only for providers you turn on

  • Your WordPress site

    What it gets
    Everything: conversations, contacts, files, settings and logs
    When
    Always

  • Your email provider

    What it gets
    The emails you send and receive
    When
    When you connect a mailbox or sending provider

  • Your messaging channels

    What it gets
    Messages on that channel
    When
    When you connect WhatsApp, Messenger, SMS or another channel

  • Your AI provider

    What it gets
    The text an AI task needs, with personal data masked first
    When
    When you connect a provider and accept the AI processing notice

  • Other tools you connect

    What it gets
    What that integration sends, such as an issue or a CRM contact
    When
    Only for integrations you set up

Each provider is optional. With strict mode on, AI tasks go only to models on your own server.

Privacy tools

Built for the rules you work under

  • Privacy requests

    Support data joins WordPress’s own personal data export and erase tools. Erasing anonymizes messages by default, or deletes them.

  • Retention rules

    Spam and drafts, timeline events, visitors and page views are cleaned up on a schedule you can change. Trash is kept 30 days.

  • Consent and the widget

    The chat widget can wait until the visitor agrees in your cookie banner (WP Consent API), and marketing consent from plugins such as Complianz or CookieYes is kept.

  • Card numbers never stored

    Card numbers are kept as their last 4 digits — always. IBANs, US social security numbers and your own patterns can be redacted or masked.

  • Masked personal data

    People without permission see personal data masked. Redact a message and the original is kept for 30 days in case of mistakes.

  • Compliance pack

    Ready-made documents about how your help desk handles data, filled in from your settings — for you to review before you share them.

✦ AI safety

AI that follows your privacy rules, not the other way round

Personal data is masked before every call to a cloud AI provider, and card numbers are always removed. No external AI call happens until an admin accepts the AI processing notice. Customer text is treated as data, so instructions hidden in a message are not followed — and attempts are logged.

Your models, your rules
  • AI disclosure on by default; turning it off needs a reason, which is logged
  • EU compliance mode: only providers and models that process data in the EU
  • “Keep AI on your own server”: local models only, no cloud AI
  • Actions go through the same permissions and approvals as your team

Account security

Sign-in and access, the WordPress way

  • Agents are WordPress users

    Your team signs in through WordPress, so your SSO and social sign-in plugins work. Requiring SSO and an IP allowlist are available too.

  • Two-factor required

    Require 2FA for your team through your site’s two-factor plugin. People get 14 days to set it up.

  • Password check for sensitive changes

    Roles, security settings and permanent deletes ask for the person’s password again.

  • Emergency lockdown

    One switch ends every session except Owners’ and Admins’ and keeps everyone else out until you turn it off.

  • Audit log

    Entries cannot be changed or deleted. Export them as CSV and run an integrity check. A read-access log can record who opened what.

  • Encrypted credentials and fields

    Stored API keys and passwords are encrypted and never shown again. Protected fields can be encrypted too.

How we build

Checked before every release

  • Static analysis with PHPStan at level 8 on every change.
  • WordPress Plugin Check and an OWASP ZAP baseline scan in continuous integration.
  • Release zips are built only by GitHub Actions from a tagged commit, with a signed build provenance attestation.
  • Every release publishes SHA-256 checksums and a list of its dependencies (SBOM).
  • Few dependencies: the free plugin bundles only Action Scheduler; Pro adds the Freemius SDK for its licence and updates.
  • Security fixes for the latest minor version, and for the previous one for 90 days after the next is released.

We use it ourselves

Our own customer support runs on Cliedesk

Degird’s central customer support runs on Cliedesk. The help desk we sell is the help desk we answer you from.

Contact us

Report a security issue

Found a vulnerability? Tell us privately.

Please report security issues in Cliedesk or Cliedesk Pro privately through our contact page at /contact/. If the form has a topic, choose “Security issue”.

Include the affected version, the steps to reproduce and the impact you expect. Please don’t disclose the issue publicly until a fix is released.

We acknowledge your report, agree a fix date with you and coordinate the release. If you wish, we credit you in the changelog.

Related

In the free plugin: data in your WordPress database, full export, privacy export and erase, retention rules, 2FA enforcement, emergency lockdown and the audit log. Cliedesk Pro adds: required SSO and IP allowlist, the read-access log, protected fields, malware scanning, private file storage and strict mode.

Compare plans

Frequently asked questions

Can’t find your answer? Search the docs or ask us.

Search the docs →Get support →
Is Cliedesk GDPR-compliant?

Cliedesk gives you the tools: data on your own server, privacy export and erase, retention rules, consent support, masking and a compliance pack. Whether your support is compliant depends on how you run your site and which providers you connect.

Do you have SOC 2 or HIPAA?

Those apply to hosted services, and Cliedesk is a self-hosted plugin — we run no service that holds your data. Strict mode helps with sensitive data, and if you need a BAA, choose an AI provider that offers one.

Does the AI provider train on my data?

That depends on the provider and your agreement with them. Cliedesk masks personal data before each call, warns you about free API keys that may be used for training, and lets you keep AI on your own server instead.

Where is my data?

In your WordPress database and your site’s storage, wherever you host it. Files can also be copied to your own private S3-compatible bucket.

Does Cliedesk contact any outside server?

The plugin sends nothing to a Cliedesk service. Cliedesk Pro checks its licence and updates through Freemius, and data reaches other providers only when you connect them.

A help desk you host, with the controls to prove it.

Install Cliedesk on your own site and keep your customers’ data where it belongs.

Get Cliedesk Pro Start free