Help desk security checklist

Support tickets can contain addresses, account details, complaints, screenshots and attachments the customer never expected to become broadly visible. Security evaluation therefore starts with the data and the people who need it, not a list of badges on a vendor landing page. The right controls are proportionate to the risk of your particular support work.

The ICO's data-security guidance describes appropriate technical and organisational measures as risk-based, covering confidentiality, integrity, availability, recovery and regular testing. This checklist translates those questions into a small-team software trial. It is buyer guidance, not a guarantee of compliance or a substitute for specialist review where the data is sensitive.

Start with the ticket data

List what enters by email, chat, web form and integrations. Can customers send identity documents, medical details or payment information? Are order notes copied from ecommerce systems? Does a chatbot see the full conversation or only a selected knowledge source? Reduce unnecessary fields and attachments before selecting a platform. A product cannot protect data you collect without a purpose.

Define which cases need restricted visibility. A general support agent may need an order status but not a complaint investigation or full billing record. Ask whether the proposed edition supports the role and field boundaries you need. Test a real permission scenario in the pilot, including what a former staff member can still access after removal.

Verify identity and access

Check MFA for every agent and admin, SSO if your team requires central account control, session management and how service accounts or API tokens are governed. Avoid shared logins; they make both accountability and offboarding weaker. Give the smallest useful role, review access periodically and remove it promptly when someone changes role. Test whether integrations inherit broad privileges and whether tokens can be rotated without stopping support.

Check protection, logs and recovery

Ask how data is encrypted in transit and at rest, and which parts of the service, exports and backups are covered. The ICO's encryption guidance treats encryption as an important measure but not a complete solution. Request a concise description of segregation, vulnerability management and independent assurance; check dates and scope rather than treating a certificate as universal coverage.

Audit records should help answer who changed roles, exported data, altered rules or viewed sensitive cases, subject to plan limits. Ask how long logs remain available and whether an admin can export them. For recovery, ask about backups, restore testing, outage communications and the expected time to regain access to customer cases. Run a small export test so the team has a fallback if the help desk is unavailable.

Treat integrations as part of the system

A Shopify, CRM, email or AI connector can move customer data beyond the help desk. List every connected service, its permissions, data sent, owner and revocation path. Do not let a browser extension or copied API key become the unreviewed route into the entire inbox. The data-residency guide explains why hosting region alone does not describe every access path.

Prepare the incident and exit process

Ask the vendor how it notifies customers of a security incident, what information it provides and which contact receives the notice. Keep your own escalation owner and a way to preserve evidence. For a serious personal-data incident, the organisation may have regulatory and customer-notification duties; seek qualified advice when needed rather than treating a vendor's email as the whole response.

Before buying, test account export, deletion, retention controls and termination terms. Zendesk's trust centre describes plan-dependent access, redaction and retention features; Freshworks provides security and data-handling detail. Use such documents as evidence to verify, not blanket endorsements.

Sources

• ICO: a guide to data security
• ICO: encryption
• Zendesk Trust Center
• Freshdesk data storage and security

This checklist is editorial buyer guidance, not legal or security advice. Confirm controls in the current contract and intended plan.