SECURITY AND DATA HANDLING
Private work stays tied to the customer account.
This page summarizes the controls implemented in Sales Desk. It is not a certification claim. See the privacy notice for retention, deletion, and data-use details.
Customer identity
Google OpenID Connect is used for customer sign-in. Sales Desk requests only openid, email, and profile identity scopes and does not request access to Gmail, Drive, Contacts, or Calendar. The application validates state, nonce, PKCE, issuer, audience, signature, expiration, and verified email before creating a session.
Sessions and account isolation
Session tokens are stored as hashes. Browser cookies are HttpOnly, Secure, and SameSite=Lax. Orders, files, generated previews, proposal imports, and assistant connections are scoped to the signed-in owner. A successful payment return URL alone does not grant project access.
Payments
Stripe processes checkout. Sales Desk does not store full card numbers. Signed Stripe webhooks connect confirmed payment or subscription status to the correct order, and repeated checkout requests use idempotency controls.
Files and generated media
Uploads and generated previews are stored in private project storage, not on the public marketing page. File type, size, count, and ownership are validated. Approved production providers may process only the assets required for authorized work.
Assistant connections
The current connector scope can save proposal text to the connected customer’s private proposal inbox and retrieve the private draft link it created. It cannot charge, publish, generate finished media, or read other customers’ data. OAuth public clients use exact HTTPS redirect registration and PKCE S256. Connection tokens are separately revocable, expire, and are rate limited. See the connector documentation.
Report a concern
Send security or privacy questions to keith@bapl.ai. Do not include passwords, payment-card details, or secret connection keys in email.