Account and workspace access
Sign-in uses an email verification code. Protect your mailbox with multi-factor authentication and never share a code. Business Desk requires separate owner approval; creating an account does not automatically grant it. The application checks identity and access on the server, and workspace records are associated with the authenticated account. Owner administration and cost tools require owner permissions.
Authorised operator access may be needed for support, security and legal administration. We do not describe the service as end-to-end encrypted or claim that the operator has no technical access.
Connections and records
The public site uses HTTPS. Application/provider credentials are handled server-side. Accounting connection tokens are encrypted before storage. Disconnecting removes our stored credentials and attempts provider revocation; review connected apps with the accounting provider as well. Previously imported records remain separately until removed.
Uploaded financial documents are temporarily retained for background extraction; extracted figures, excerpts and review history have separate lifecycles. Keep your originals. Use the source and correction controls to check proposed figures before treating them as business records.
AI processing and appropriate inputs
AI features transmit relevant evidence to the processing provider. This is not an offline or UK-only analysis service. Do not upload excluded personal information, privileged files, credentials or data you are not authorised to share. A confidentiality obligation or a no-training default does not mean a provider retains no data.
Read the privacy notice and provider directory. Customers with special residency, retention or regulated-data requirements should agree supported safeguards before supplying that data.
Export and deletion
Use Data & preferences for an application-data export and workspace deletion controls. Business Desk also provides its own data export and reset. Destructive operations require confirmation. Workspace deletion is different from sign-in account closure, financial-record erasure and provider-backup expiry. Contact support for a request covering those systems.
A paid order should state agreed exit arrangements. Do not treat a workspace as your only accounting record or backup. No recovery time, independent penetration-test result, ISO certification or SOC 2 certification is claimed on this page.
Report a security concern
Email support@brighterdesk.com with “Security” in the subject. Include the affected page/function, time, a safe description and how to reach you. Do not email passwords, API keys, verification codes, card details or a full copy of someone else’s records. Stop testing if you encounter another person’s information. We will arrange a suitable way to exchange further evidence if needed.
This contact is not a promise of a continuously staffed emergency service. Business breach-notification duties are set out in the DPA and apply independently of ordinary support response targets.
Questions about this document? support@brighterdesk.com