Data flow at a glance
Zendesk supplies ticket and user context. When AI features are enabled, relevant reply text and time context can be sent for detection, completion checks and briefing generation. Promise records can contain installation, ticket, customer and agent identifiers, summaries, excerpts, categories, confidence, deadlines, status and audit events.
Service providers
The current privacy notice states that Supabase stores Promise records and settings, OpenAI performs enabled AI processing and Railway hosts the backend. The source and infrastructure configuration for those services are not in this checkout, so regions, model terms and backup settings must be confirmed during a security review.
Controls and retention
The published privacy notice states that Zendesk access credentials are encrypted and installation tokens are hashed. It also describes operational logs retained no longer than seven days, encrypted backups expiring within 30 days and manual deletion or irreversible anonymization within 30 days after uninstall, subject to legal, security or dispute needs.
No invented certifications
Promise does not claim SOC 2, ISO 27001, HIPAA, end-to-end encryption or another unverified certification. Organizations should request the current DPA, subprocessor details and technical answers from Otisa before purchase.
Questions about Promise security
Does Promise use ticket content?
Yes. Relevant public reply text and context are processed to provide commitment features.
Is every security detail verified from code here?
No. The public disclosures were reviewed, but backend and infrastructure source are absent from this checkout.
How can I ask a security question?
Email hello@otisa.io with the Zendesk organization and the specific control you need reviewed.