Security
Your clients' data, handled with care.
Agencies hold contracts, invoices and personal details for other businesses. Here is how SparkDesk controls who sees what, keeps a record of changes, and lets you take your data with you.
Access control
- Organization roles (owner, admin, member, read-only) plus read, write, delete and admin rights per module.
- Visibility roles on Business and Enterprise narrow which records each person can see, using filter rules.
- Two-factor sign-in for workspace members.
- Clients use a separate portal sign-in and only see what you share with them.
Workspace security policies
- Owners and Admins can require two-factor sign-in for everyone, with a grace period to set it up.
- Password rules apply every time someone sets a password.
- People are signed out after a period of inactivity that you choose, with a warning first.
- Invitations can be limited to your approved email domains, and every policy change is recorded in the audit log.
Accountability
- An audit log records who changed what, and when.
- Every record keeps a timeline of changes, including changes made through the API.
- Deleted records go to trash, where admins can restore them.
- Every API and MCP request is logged with the person, key, tool and result.
API keys and AI assistants
- Personal API keys and OAuth connections run with the person's own role and permissions.
- Service keys for shared integrations can only be created by admins and owners.
- Admins can list and revoke keys and see their activity.
- Connected AI assistants can be disconnected at any time from Connected apps.
Your data
- Owners and Admins can export every record in the workspace as JSON and CSV, with links to uploaded files, at any time. There is no lock-in.
- Owners can delete the workspace from Settings. Access is locked straight away, and the data is removed after 14 days.
- Anyone can delete their own account and personal profile from their profile settings.
- Data is sent over HTTPS, and our database and hosting providers encrypt stored data.
- We list every subprocessor that handles customer data, with what it handles and where.
Reviews and reports
Running a vendor security review? Enterprise plans include security review support. To report a vulnerability, email hello@sparkdesk.io with the details and we will respond.
See also our Privacy Policy, subprocessors and permissions and security features.
Run your next client project in SparkDesk.
Start a 14-day free trial of any paid plan. No card needed, and you can drop to the Free plan at any time.