Security at deskmy
deskmy is an office where people and AI agents work side by side — so governance is built in, not bolted on. Set boundaries in plain English, keep every agent action on the record, and run the whole office in our cloud or yours.
Governed by boundaries
You describe limits in plain English — the way you'd say them to a manager. deskmy compiles each boundary into rules, gives you an English readback of exactly what it covers, and backtests it against your real agent activity before anything goes live.
Boundaries can run in fail-closed allow-list mode: when in doubt, the agent asks first. Approver roles decide who can grant exceptions.
Every action on the record
Every agent action is written to a tamper-evident, hash-chained activity record — entries can't be edited or deleted without breaking the chain. You can ask the record questions in plain English.
You can check the receipts. Audit export for SIEM and compliance tooling is available on Enterprise plans — talk to us.
Humans in the loop
Actions with external side effects — sending email, spending money, deleting data — wait for explicit human approval. Approvals are durable: an agent pauses and resumes when a human decides, even hours later.
On the managed remote computer, sign-in requests and 2FA challenges are forwarded to a human rather than handled by the agent.
Agents that learn safely
When a human takes the wheel and demonstrates a task, deskmy condenses the session into quarantined learnings. Nothing becomes a reusable skill silently — learnings promote only by your confirmation or review.
Access & identity
Sign in with Google or Microsoft single sign-on. SAML and SCIM provisioning are available on Enterprise plans — talk to us about your identity provider.
Each workspace is isolated: your conversations, Vault, and agent activity are never shared with other companies, and your data is not used to train models for third parties.
Deployment options
Cloud — the hosted product at deskmy.com, with per-company isolation.
Dedicated — your own instance on our infrastructure, for teams that want a separate environment.
Self-hosted — for regulated buyers, the same product deployed in your building. Self-hosted deployments can run without outbound telemetry. Talk to us about requirements.
Data handling
Data in transit is encrypted. Workspace content is processed only on your workspace's instructions — deskmy acts as processor, your company stays the controller.
The full detail lives in our privacy policy and terms of service.
Questions & reports
Security questions from buyers, admins, or researchers: [email protected]. For Enterprise requirements — SSO, self-hosting, audit export, SLAs — talk to our team directly.