Skip to main content

1Desk & GDPR Data Architecture

1Desk is engineered for strict data sovereignty. Unlike proprietary SaaS helpdesks that pool all customer messages in a single multi-tenant vendor cloud, 1Desk is deployed directly on your dedicated infrastructure.

This guide outlines the precise data flow, the role of upstream AI APIs, and how the architecture satisfies General Data Protection Regulation (GDPR) requirements.

1. Where Customer Data Lives​

  • Persistent Message Storage: All message threads, customer names, phone numbers, and operational timestamps reside directly on your dedicated 1Desk server and connected PostgreSQL / SeaTable database.
  • No Secondary Marketing Copies: 1it.pro does not aggregate your customer records, sell user behavior, or store copies on external marketing platforms.
  • Backups Under Your Control: Database backups remain encrypted within your defined infrastructure boundaries.

2. Upstream AI API Data Flow​

When AI Tier-1 automated assistance is activated (via Dify or direct API connections):

[ Customer Message ] ──> [ 1Desk Local Server ] ──(TLS / HTTPS)──> [ Upstream LLM API (OpenAI/Anthropic) ]
                                                                                   │
[ Database / CRM ] <──── [ 1Desk Local Server ] <──(TLS / HTTPS)──[ Completion Response ]
  1. Encrypted In-Transit: When a customer sends a query requiring an AI response, the relevant text snippet and verified knowledge chunks are transmitted over encrypted HTTPS (TLS 1.3) to the designated model provider.
  2. Zero Model Training on Your Data: Under enterprise API terms with commercial providers (such as OpenAI and Anthropic), API payloads are not used to train foundation models.
  3. Strict Ephemeral Processing: The upstream provider processes the completion and returns the generated answer to your 1Desk instance without retaining your private data for public retrieval.
Private Local LLM Option

If your regulatory environment strictly prohibits transmitting any customer text over public cloud APIs, 1Desk can be configured with an air-gapped or on-premises local LLM cluster running on private client hardware.

3. GDPR Roles & Responsibilities​

To ensure compliance under European data protection legislation:

  • Data Controller: Your company retains primary legal control over customer records, setting data retention policies and managing customer consents.
  • Data Processor: 1it.pro acts as the technical processor responsible for server maintenance, security patching, and infrastructure availability under our standard service agreement.
  • Sub-Processors: Cloud infrastructure hosts (e.g., Hetzner, AWS) and AI API providers operate as designated sub-processors bound by standard Data Processing Addenda (DPAs).

4. Exercising Data Subject Rights​

Because records are organized in standard relational tables:

  • Right to Access & Portability: An administrator can export an individual customer’s entire chat transcript and CRM profile as CSV or JSON.
  • Right to Erasure (Right to Be Forgotten): Customer records and associated conversation threads can be purged permanently upon verified request.