Trust center
How we look after your Zendesk data
Where your data lives, the controls we use, how long we keep things and who helps us run the service. Plain facts, no badges we haven’t earned.
- Most apps stay inside ZendeskMost TGT apps run entirely inside Zendesk and store data only in your account: app settings and, where needed, Custom Objects.
- Separate access per appApps that need the TGT app service connect only after a Zendesk administrator approves access, with a separate OAuth client per app.
- No selling, no AI trainingWe don’t sell personal information or use customer data to train general AI models.
- No trackers on this siteThis website has no analytics, advertising trackers or tracking cookies.
Where your data lives
Your organization controls its Zendesk records, permissions and retention. Installing a TGT app doesn’t transfer ownership of your data, and an app acts only on your organization’s instructions.
- Inside Zendesk: most TGT apps run entirely inside Zendesk and store data only in your account.
- TGT app service: some apps use it for work Zendesk can’t run on its own. It stores its data in the United States (Cloudflare’s eastern North America region).
- Per app: each app page has a “Your data” section that says exactly what that app reads, stores and changes.
Controls on the TGT app service
- Connects only after a Zendesk administrator approves access on Zendesk’s own authorization screen.
- A separate OAuth client for each app, with only the permissions that app needs.
- Tokens and keys encrypted at rest, kept in an isolated component with its own encryption key that only the service can reach.
- Zendesk’s signature verified on every webhook and app request, and requests rate-limited.
- An account’s data deleted when the app is disconnected or uninstalled.
Retention and deletion
| Information | How long we keep it |
|---|---|
| Records an app creates in your Zendesk account | Under your account’s control. Uninstalling may not remove them, so follow the app’s removal instructions. |
| TGT app service data | While the app is connected. Deleted when an administrator disconnects it, or within a day of uninstalling. |
| Completed scheduled items and webhook duplicate checks | Deleted after 7 days. |
| Deleted service data in encrypted backups | Up to 30 days, then permanently removed. |
| Support correspondence | As long as needed to resolve the request and support the relationship. |
| Billing records | As long as accounting, tax and legal obligations require. |
Providers we use
Each provider processes information under its own terms, for its part of the service.
| Provider | What it does for us |
|---|---|
| Cloudflare | Website hosting, the TGT app service and the TGT holiday service |
| Zendesk | Marketplace and platform |
| Stripe | Payment processing. We never receive full card numbers. |
| Zoho Mail | Business email |
AI
We don’t use customer data to train general AI models. If a TGT app ever uses AI, its app page and Marketplace listing will say what for and what data is involved before you install.
What we don’t claim
We describe the controls we actually use instead of claiming certifications we don’t have. We don’t claim SOC 2 certification, a guaranteed absence of vulnerabilities or an absolute security guarantee. No system is perfectly secure.
Policies and documents
- Privacy PolicyWhat we collect, why, and your rights
- SecurityControls, responsible testing and reporting
- App TermsThe terms for using TGT apps
- BillingTrials, subscriptions, cancellation and refunds
- AccessibilityOur approach and how to report a barrier
- Legal noticesCompany details and notices
Report a concern
To report a security issue, follow the steps on our Security page: start with a short, redacted summary and leave out credentials or live customer data. For privacy requests, see the Privacy Policy.