---
title: "Security Overview | ThriveDesk"
canonical: "https://www.thrivedesk.com/security/"
author: ThriveDesk
description: Security Overview for ThriveDesk customers and site visitors.
categories: [legal]
---

# ThriveDesk Security

## How we keep customer data secure

-   We use two-factor authentication for ThriveDesk.
-   All our Secure Shell (SSH) access is password protected.
-   All computers and devices running ThriveDesk service tools are secured and kept up to date.
-   All ThriveDesk employees are trained in data security practices.
-   ThriveDesk employees can only access data at their own security level. We have built an internal system that requires different permission levels for different employees.

## Infrastructure hardening

-   Servers run the latest security updates and are patched immediately when a kernel vulnerability is published.
-   All servers are in the United States.
-   We maintain denial-of-service protection everywhere, which keeps the service running under attack.
-   If hardware fails, our micro-services are replicated so the service keeps running.
-   Our databases are replicated around the world in different layers.
-   Our networks are protected with firewalls.
-   Our monitoring lets us spot issues before they affect our customers.
-   ThriveDesk infrastructure is designed to keep running properly if a server has an incident or fails.
-   All ThriveDesk domains are secured with DNSSEC.
-   ThriveDesk’s SSH services are not publicly reachable and are limited to a set of allowed IPs.
-   IPs that misuse the service are automatically banned or rate-limited, which prevents brute-force attacks on accounts.

ThriveDesk complies with the [GDPR](https://www.thrivedesk.com/gdpr/). You can read our GDPR-oriented [privacy policy](https://www.thrivedesk.com/legal/privacy/).

## Encryption everywhere

All public network channels on the ThriveDesk platform are fully encrypted. That covers both asset loading (web resources) and real-time chat channels (user messages and user data).

Our encryption follows current best practices:

-   Strong TLS keys: RSA, 2048 bits
-   Elliptic-curve cryptography
-   Forward secrecy with Diffie-Hellman parameters
-   HTTP Strict Transport Security

We dropped legacy encryption methods to prevent known attacks:

-   The old SSL protocol is completely disabled (we use TLS).
-   Legacy ciphers are disabled (e.g. RC4).

This keeps you and your users safe:

-   Data is hidden while it travels over the network.
-   Data can’t be modified while it travels over the network.
-   Man-in-the-middle (MITM) attacks are prevented.
-   The service works on restricted networks and through strict proxies.