Security at DM DESK

DM DESK serves its website, dashboard, chat and app over HTTPS, its database is encrypted at rest, and each business's records are kept separate. Our AI providers work under commercial terms that do not allow training on your data, and card payments stay on your own checkout.

Encrypted in transit and at rest
Isolated per business
No AI training on your data
Payments stay on your checkout
Hosted in the United States

Last reviewed October 13, 2026

Book a free setup call Try it on your business

Infrastructure

Encrypted in transitThe website, dashboard, chat and app are served over HTTPS. Our servers reach our database and providers over encrypted connections.
Encrypted at restThe database and its backups are encrypted at rest by our database provider.
Isolated per businessEach business's records are walled off at the database level, so one business's team cannot read another's.
Connected account tokens encryptedAccess tokens for the accounts you connect, like Instagram, Square and Shopify, are encrypted before they are stored.
Hosted in the United StatesOur database and application servers run with established cloud providers in the United States.
Limited access to productionAccess to production systems is limited to what is needed to run the service.
Two factor authenticationAdmin access to our hosting, database, code, billing, company email and text message accounts is protected with two factor authentication.

Application security

Automated testingAutomated tests run before code is released.
Code review before releaseOur release process has a review step before code goes live.
Error monitoringUnexpected errors on our servers are tracked automatically. Some failures also email our team.
Bot and abuse protectionThe form that builds a demo and our booking form are screened for bots, and website chat limits how many messages one visitor can send.
No Instagram password sharedInstagram connects through Meta's own login for businesses. DM DESK does not ask for your Instagram password.

AI and your data

No training on your dataOur AI providers work under commercial terms that do not allow training on your data.
No sharing between businessesYour assistant answers from your own business's information. It is not given another business's conversations.
Tells customers what it isWebsite chat opens by saying it is your AI assistant. On Instagram, the assistant is built to say it is an automated assistant in its first reply.
Built not to pose as a personIt is designed never to claim to be human, and it answers honestly when asked.
No voice recordings kept by DM DESKIn website chat, voice is turned into text. DM DESK does not store voice recordings.
No sale of personal informationDM DESK does not sell personal information. Your customers' messages are not used for advertising or given to data brokers.

Data lifecycle

BackupsData is backed up automatically every day.
Delete your account yourselfYou can delete your account from Settings. It is deleted right away.
Customer data deleted after you cancelAbout 30 days after your subscription ends, DM DESK automatically deletes the customer conversations, contact details, leads and order links it holds for your business at that time.
Deletion runs dailyAn automated job runs once a day. It deletes your customer conversations, contact details, leads and order links once your subscription has been over for 30 days.
Disconnecting stops accessWhen you disconnect Instagram or Square, DM DESK stops using the connection and erases its stored access tokens right away.
Deletion requestsWe reply to an emailed deletion request within 10 business days to confirm we have it. Deletion is completed within 30 days of a valid request.

Payments

Payments stay on your checkoutDM DESK has no card form. Customers pay on your own checkout, and your checkout provider processes the card.
Billing through StripeWhen you subscribe on dm-desk.com, your plan is billed through Stripe, and you enter your card on Stripe's own page. Stripe states that it is a PCI Service Provider Level 1.

Policies and reviews

Data Processing AddendumOur Data Processing Addendum is part of our Terms. Under it, DM DESK handles your customers' personal information as your service provider.
Meta App ReviewOur Instagram messaging access passed Meta's App Review.
Security incident noticeIf we learn of a security incident that affects your customers' personal information, we notify you without undue delay.

Report a security issue

If you believe you have found a security issue, write to us.

security@dm-desk.com

Who handles your data

The providers that handle customer information, what each one does and where it is located.

See our subprocessors

Deleting data.

About 30 days after your subscription ends, DM DESK automatically deletes the customer conversations, messages, contact details, leads and order links it holds for your business at that time.

Your account itself, meaning your business profile, settings, menu and logins, is kept until you delete it or ask us to. Email privacy@dm-desk.com from the email address on the account, and we delete it within 30 days. You can also delete your account yourself, right away, from Settings on the website or in the DM DESK app.

A customer who messaged your business can ask for their conversation to be deleted. They email privacy@dm-desk.com with the subject Data Deletion Request, the business they messaged and roughly when. A person on our team checks the request is really theirs, deletes the conversation with any lead and contact details saved from it within 30 days, and replies once it's done. A website chat visitor can also ask the business directly.

Some information may stay briefly in backups and is cleared on our normal backup rotation. A few records are kept after an account is deleted, and our Data Deletion Instructions list them.

Voice in website chat.

When a customer speaks on your website chat, our speech provider turns the recording into text. DM DESK does not keep the recording. The provider says it may keep what is sent to it for up to 30 days to watch for abuse. It says it may keep it longer where the law requires or to protect its service or others from harm. The text of the conversation is kept like any other chat.

Disconnecting an account.

When you disconnect Instagram or Square in DM DESK, or remove DM DESK from your Instagram settings, DM DESK stops using the connection right away and erases the stored access tokens.

A menu imported through a Square connection is deleted within 30 days unless you connect Square again.

Questions owners ask.

Does DM DESK use my customers' messages to train AI?

No. DM DESK does not train AI models on your data or your customers' messages, and our AI providers work under commercial terms that do not allow training on your data.

Can DM DESK see my customers' card numbers?

Customers pay on your own checkout, and DM DESK has no card form. If a customer types a card number into a chat, DM DESK masks the numbers it recognizes before the message is saved.

How does a customer get their conversation deleted?

They email privacy@dm-desk.com with the subject Data Deletion Request, the business they messaged and roughly when. We confirm it's theirs, delete it within 30 days, and reply once it's done.

What happens to my data if I cancel?

About 30 days after your subscription ends, DM DESK automatically deletes the customer conversations, messages, contact details, leads and order links it holds for your business at that time. Your account is kept until you delete it or ask us to. You can delete it yourself, right away, from Settings.

What happens when I disconnect Instagram or Square?

DM DESK stops using the connection right away and erases the stored access tokens. A menu imported through a Square connection is deleted within 30 days unless you connect Square again.

Does DM DESK keep voice recordings?

No. Recordings are turned into text by our speech provider and are not kept by DM DESK. The provider says it may keep what is sent to it for up to 30 days to watch for abuse. It says it may keep it longer where the law requires or to protect its service or others from harm.

Our policies.

Set it up with us on a free call.

Book a free 30 minute setup call. We set up DM DESK with you on your real products or menu, prices and hours.