Encryption in transit
Public endpoints use TLS. The pilot load balancer uses a TLS 1.2+ policy once its certificate is attached. This marketing distribution redirects HTTP to HTTPS and sends HSTS for lystdesk.com only, not for every subdomain.
Trust
Designed for SOC 2 Type II and ISO/IEC 27001 readiness
These are controls we run and evidence we collect. They are not a certification. LystDesk is not SOC 2 certified and not ISO/IEC 27001 certified.
Encryption at rest
The pilot database, objects, queue, and cache use a customer-managed key. Marketing files are the public site, encrypted with S3-managed keys, and the bucket is not public.
Tenant isolation
Every tenant table is behind row-level security. The application role does not bypass it. A coverage test fails if a new tenant table ships without the policy.
Sign-in
Agents use a password and an authenticator. Billing, export, custom domains, erasure, and workspace deletion ask for a fresh authenticator code. Google sign-in is on the plan catalogue. SAML is on Pro, and it is not a claim that every workspace has SSO turned on.
Audit
Security-relevant actions land in an append-only audit log. Lystloc staff access to a tenant is a time-limited grant the tenant can see. There is no standing staff access to ticket contents.
Payments
Card numbers stay at Stripe. LystDesk stores customer and subscription identifiers and the USD receipt. This release does not charge INR and does not add GST.
Backups
Database snapshots and attachment copies are designed to land in Hyderabad as well as Mumbai. A failed backup job raises an alert. The public status page is separate infrastructure.
Readiness, not a certificate
The program is designed for SOC 2 Type II and ISO/IEC 27001 readiness: controls and evidence. LystDesk is not SOC 2 certified and not ISO/IEC 27001 certified. No auditor report is claimed.
Hosting in v1 is India: the application in AWS Mumbai, backup copies in Hyderabad. That is a residency fact for this version, not the headline of the product. A sub-processor summary and the DPA draft are public; counsel finalizes them before general availability.
DPA · Sub-processors · DPDP · Privacy