ThriveDesk Security

How we keep customer data secure

• We use two-factor authentication for ThriveDesk.
• All our Secure Shell (SSH) access is password protected.
• All computers and devices running ThriveDesk service tools are secured and kept up to date.
• All ThriveDesk employees are trained in data security practices.
• ThriveDesk employees can only access data at their own security level. We have built an internal system that requires different permission levels for different employees.

Infrastructure hardening

• Servers run the latest security updates and are patched immediately when a kernel vulnerability is published.
• All servers are in the United States.
• We maintain denial-of-service protection everywhere, which keeps the service running under attack.
• If hardware fails, our micro-services are replicated so the service keeps running.
• Our databases are replicated around the world in different layers.
• Our networks are protected with firewalls.
• Our monitoring lets us spot issues before they affect our customers.
• ThriveDesk infrastructure is designed to keep running properly if a server has an incident or fails.
• All ThriveDesk domains are secured with DNSSEC.
• ThriveDesk’s SSH services are not publicly reachable and are limited to a set of allowed IPs.
• IPs that misuse the service are automatically banned or rate-limited, which prevents brute-force attacks on accounts.

ThriveDesk complies with the GDPR. You can read our GDPR-oriented privacy policy.

Encryption everywhere

All public network channels on the ThriveDesk platform are fully encrypted. That covers both asset loading (web resources) and real-time chat channels (user messages and user data).

Our encryption follows current best practices:

• Strong TLS keys: RSA, 2048 bits
• Elliptic-curve cryptography
• Forward secrecy with Diffie-Hellman parameters
• HTTP Strict Transport Security

We dropped legacy encryption methods to prevent known attacks:

• The old SSL protocol is completely disabled (we use TLS).
• Legacy ciphers are disabled (e.g. RC4).

This keeps you and your users safe:

• Data is hidden while it travels over the network.
• Data can’t be modified while it travels over the network.
• Man-in-the-middle (MITM) attacks are prevented.
• The service works on restricted networks and through strict proxies.