Helpdesk / Security and data
Privacy and security
- Private by default. Settings decide whether customers may make a ticket public, only staff can, or every ticket stays private.
- Sensitive messages. Staff can mark a reply or a file as sensitive, and a visitor can mark their opening message as sensitive on the support form and in the popup. The text is encrypted and stays out of email and the public archive; the subject stays visible. The requester can reveal it on their ticket page and send sensitive replies and files. Justflows creates the 32-byte
JUSTFLOWS_HELPDESK_KEKin the server.envwhen Helpdesk is active, and the key is never stored in the database. Staff needhelpdesk.secrets:reveal, each reveal is recorded, and the nightly job destroys expired secrets. - Retention. Closed tickets can be removed after a set number of months. Deleting the plugin with Remove all data also removes its tickets, files, and support pages.
- Abuse limits. Blocked email domains and a limit on open tickets per customer refuse requests early. CAPTCHA can guard a new ticket, a reply, Find a request, and the popup; the provider itself is set under Settings → Discussion → Spam protection.