DutyDesk
Security and privacy

Where your data lives, and who sees it

Your conversations are stored on servers in Tel Aviv, and in the dashboard only you and your team can see them. We don’t sell them and we don’t use them to train AI. This page says plainly what we keep, where data goes and who can reach it.

What we hold
Conversations, contacts and fixed replies in our database in Tel Aviv, in one region, and they do not leave it.
How the keys are held
The WhatsApp session and every connector token are sealed with AES-256-GCM, under a key that belongs to the workspace alone, before they touch the database. The key that protects those keys lives in Google Secret Manager, not in the database.
Disconnection and erasure
Disconnecting a channel destroys its credentials and ends the link immediately. Deleting a workspace erases it after 30 days, and the backups after 60.

What we keep, and what goes out

Every kind of data a workspace keeps with us, and where it goes. This is the full list.

Data
Where it goes
Status
Message content
Stored in our database, on a server in Tel Aviv
With us
Contacts and customer records
The same database, on the same server
With us
Rules, flows and campaigns
The same database
With us
The WhatsApp connection
Runs on our server — we hold the sign-in, encrypted
With us
A Telegram bot
Messages pass through Telegram’s official Bot API
Third party
Instagram and Messenger
Not available yet. When they are — through Meta’s official Graph API
Third party
Text sent for an AI reply
To Anthropic’s Claude (or Google’s Gemini, if your workspace runs on it), on our own keys, only while AI replies are on
Only if switched on
Voice notes
To Google’s Gemini for transcription. On by default, and one switch in Settings turns it off
Third party
Google Calendar
Busy times are read from it. If you choose a calendar for appointments, each one is written into that one calendar, with the customer’s name and phone number — only if you connect it
Only if switched on
Email and team alerts
Sent from our Google mailbox, or by our Telegram bot to members who linked it
Third party
Nightly backup
To Google Cloud Storage in the same region, deleted after 60 days
With us

We don’t sell or rent messages and contacts, and we don’t use them to train AI. Neither does Google, which writes the AI replies and the transcripts.

Your account, and who can see what

Your account holds your email address, the billing details for invoices and your team members. The workspace also holds the conversations themselves, which its members see. On our side, the staff console shows plans, usage and counts, but not messages, contacts or conversations. The people who run the servers can reach the database itself, and do so only to fix a fault or to handle a request from you. A workspace you delete is erased after 30 days.

Password
Stored hashed with scrypt and a random salt. The password itself is kept nowhere and cannot be recovered.
Sign-in session
An HttpOnly cookie that code in the browser cannot read, good for 30 days. The server keeps only a hash of it.
Two-step sign-in
Available with an authenticator app, with ten recovery codes for the day the phone is not to hand.
Payment card
It never passes through us and is never stored with us. The card and the processing sit with Stripe alone.
Deleting a workspace
Its conversations, contacts, appointments, fixed replies and menus are erased for good after 30 days, and every channel is disconnected at once. Invoices stay with Stripe.
This translation is provided for convenience. The Hebrew text is the binding version and prevails in any conflict.

One thing to know about WhatsApp

Concierge connects to WhatsApp the way WhatsApp Web does, not through Meta’s official business API. That goes against WhatsApp’s terms, so there is a risk the number gets blocked, mostly when you send a lot of messages.

We don’t hide this, and we don’t promise it won’t happen. What we do: the bot replies at a calm pace from day one, by default, without you having to remember to switch it on.

Telegram doesn’t have this risk, because it works through the official bot API. If you want to start with no risk at all, start there.

WhatsApp is a trademark of Meta Platforms, Inc. This product is not affiliated with, endorsed by or sponsored by Meta, and does not use the official WhatsApp API.

What lowers the risk
Random pause before replying
2–8 seconds
Gap between replies to one contact
60 seconds
Daily cap per connection
Optional · 200 suggested
Replies in groups
Off by default · only when mentioned
Campaign pace on WhatsApp
6 a minute · 20 at most
Pause the bot
One switch in Settings · or one conversation
The pause and the gap between replies are on by default, and the daily limit is one switch away. You can adjust each of them, except the top speed of a WhatsApp campaign, which can’t be raised.

What we check before every update

Nothing goes live because “it worked on my machine”. Before every update all the automated tests run, including rebuilding the database from scratch, so problems are caught by us and not by customers.

92
Automated suites
The reply engine, menus, billing and the connectors. They run on every push.
107
Migrations
Replayed from empty on every push, and checked for schema drift.
5
Interface languages
Including full right-to-left layout for Hebrew and Arabic.
1
One region
Everything in me-west1. Nothing is replicated anywhere else.

A question this page does not answer?

The guide has the technical detail: what exactly is stored, where, and for how long.

Read the guideRegister