# Security

How Texa protects your data and your customers: sign-in, isolation, encryption, what Texa AI may and may not do, and how to stop it.


Short answers for your security review. Ask
[info@texadesk.com](mailto:info@texadesk.com) for the full security pack.

## Sign-in and access

- **Multi-factor authentication** (an authenticator app, with backup codes) for each person.
- **[Single sign-on](/desk/sso)** with Microsoft Entra ID, Google Workspace or any SAML 2.0
  provider, only for your own proven domains, optionally enforced.
- Texa's own staff always sign in in two steps.
- Sign-in attempts and password resets are rate-limited.
- **Roles:** administrators, agents, and custom roles with only the permissions you give. People see
  only their own inboxes and teams.

## Your keys

- Texa API keys are shown **once**; only a hash is kept. Revoke one and it stops at once.
- Widgets never hold a key: your server makes a short-lived session for one customer, valid only
  on the websites you list.
- Everything Texa sends you is **signed** (HMAC-SHA256 with a timestamp).
  [How to check](/authentication#checking-what-texa-sends-you)

## Isolation and encryption

- Every company's data is kept apart by row-level security in the database, tested on every table.
- Every secret Texa keeps for you (your API keys for connectors, webhook secrets, helpdesk keys) is
  sealed with AES-256-GCM, under keys outside the database, and never written to a log.
- TLS for everything in transit; connectors call only `https` in live.

## What Texa AI may do

- **Only actions you connected**, only in a step of a procedure a named person approved.
- **Changes need the customer's yes**, and verification first where the action says so.
- **Private fields** (an amount, an account number) are never said to an unverified customer.
- **Failures are told as failures:** Texa AI never claims an action succeeded when it didn't.
- Connectors never reach a private address (no server-side request forgery), and follow no
  redirects.
- Card numbers, PINs, passwords, CVVs and verification codes are masked before any AI model reads
  them.

## Stopping it

Switch Texa AI off at once: for the whole account (**Texa AI → Safety**), for one inbox, one helpdesk
connection, one Relay or one key. Conversations go to your team.

## Audit

Settings → Audit logs records sign-ins, settings changes, SSO, and every view of a sensitive ticket;
Texa AI's settings changes are recorded with who made them. Every action call is recorded with its
result, with sensitive values hidden.

## Privacy

Texa follows the Nigeria Data Protection Act 2023. You can export a conversation, and
[forget a customer](/guides/customers#forget-a-customer) on request. The services Texa uses and
what each receives are in the [privacy notice](https://texadesk.com/privacy). When a company closes its
account, its data is deleted: [closing an account](/hosting/account-closure).

## Reporting a vulnerability

Write to [info@texadesk.com](mailto:info@texadesk.com) with what you found and how to
reproduce it. Please don't test against other companies' accounts or real customers.