Answers for your security review.
How Supportman handles customer data, which third parties process it, and what we can provide during a vendor assessment. Written to answer a security questionnaire directly, without requiring a call.
Read-heavy on your system of record.
Supportman reads conversation data from Intercom, surfaces it in Slack as notifications, reminders, and reports, and records structured decisions back into Intercom. It does not reply to your customers, close conversations, or delete data. Approval outcomes are written back to the Intercom conversation as a permanent note, rather than living only in a Slack thread that ages out of retention.
| Capability | Status |
|---|---|
| Read Intercom conversations, contacts, companies, teammates, and tags | Yes |
| Post messages, reports, and approval cards into Slack | Yes |
| Write decision notes onto an Intercom conversation | Yes |
| Reply to your customers | No |
| Close, snooze, or reassign Intercom conversations | No |
| Delete anything in Intercom | No |
All data stored and processed in the United States.
| Component | Provider | Region |
|---|---|---|
| Application servers | Heroku (AWS) | us-east-1 — N. Virginia |
| Primary database | MongoDB Atlas (AWS) | us-west-2 — Oregon |
Encrypted in transit and at rest
TLS on every hop — between your browser and Supportman, and between Supportman and Slack, Intercom, and every subprocessor below. Data at rest is encrypted by the underlying platform providers.
Per-tenant OAuth tokens
Access to Slack and Intercom is via OAuth tokens scoped to your workspace and held per tenant. We hold no standing credentials into your systems beyond the tokens you grant, and revoking the app terminates that access immediately.
Authenticated inbound webhooks
Slack requests are verified against the request signature and timestamp, Intercom webhook deliveries against the app signing secret, and scheduled job endpoints require a shared secret.
Vulnerabilities are caught before the merge.
Most breaches in software of this shape do not come from an exotic attack — they come from a known vulnerability in a dependency nobody was watching. So the scanning runs continuously and the pipeline is the enforcement point: a change that fails a security gate does not ship, regardless of who wrote it.
Continuous dependency scanning
Aikido watches every open-source dependency we ship for known CVEs and for packages flagged as malicious, so a compromised transitive package surfaces as an alert rather than a production incident.
Secrets detection
Source is scanned for leaked API keys, tokens, certificates, and credentials. Integration secrets live in environment configuration, never in the repository.
Static analysis on the code itself
Aikido runs static application security testing across the codebase, flagging insecure patterns in the code path before a change is merged rather than after it ships.
Automated patching
Dependabot opens grouped update pull requests weekly for both application packages and CI actions, so patches land in small reviewable batches instead of accumulating into a risky annual upgrade.
Every change runs the full pipeline
- High-severity dependency vulnerabilities reject the build outright
- Lint, format, and full TypeScript type checking
- Unit and database-backed test suites with enforced coverage gates
- Changed-line coverage and flake checks on modified tests
- Production build plus a smoke boot of the compiled application
- Post-deploy browser smoke tests, alerting to Slack on failure
Every third party that touches your data.
We notify customers in advance of adding or replacing a subprocessor that processes customer data.
| Subprocessor | Purpose | Data it can access |
|---|---|---|
| Heroku (Salesforce) | Application hosting | All data in transit through the application |
| MongoDB Atlas | Primary database | All stored data — teams, users, conversations, ratings, approvals |
| Intercom | Source system | Your conversation and contact data, in your own workspace |
| Slack | Notification destination | Content delivered into your Slack channels |
| Stripe | Subscription billing and payments | Billing contact and payment details. Card data is entered directly with Stripe — Supportman never receives or stores card numbers |
| Mailjet | Transactional and authentication email | Recipient email addresses and message content |
| OpenAIOpt-in | AI conversation evaluations | Conversation content — only when AI evaluations are enabled |
| LangfuseOpt-in | LLM prompt management and tracing | Evaluation inputs and outputs — only when AI evaluations are enabled |
| New Relic | Application monitoring and log management | Operational logs and performance telemetry |
| Better Stack | Log management | Operational logs |
| PostHog | Product analytics | Product usage events and workspace identifiers |
| Mixpanel | Product analytics | Product usage events and workspace identifiers |
You choose how much lands in Slack.
Intercom conversation content is the broadest category of data Supportman accesses, and it may contain personal or confidential customer information. Moving that into a Slack channel widens the audience for it, so notification content is configurable per workspace. With the contact toggles off, a notification still reports the rating, the remark, and the responsible teammate, but omits the customer's direct contact identifiers.
| Setting | Effect | Default |
|---|---|---|
| showCustomerEmail | Include or suppress the customer's email address in rating notifications | Enabled |
| showCustomerPhone | Include or suppress the customer's phone number in rating notifications | Enabled |
| showRatings | Whether rating detail is sent in weekly reports at all | Enabled |
| showReport | Whether the weekly report body is sent at all | Enabled |
AI conversation evaluations are off by default
Supportman can run AI quality evaluations over conversations. This is disabled by default and must be explicitly enabled per workspace. When enabled, conversation content is transmitted to OpenAI for evaluation and to Langfuse for prompt management and tracing. A workspace left at NONE sends no conversation content to either provider. A further setting restricts evaluation to human-handled conversations, excluding bot-handled ones.
No conversation content is sent to any AI provider.
Evaluate conversations that received a customer rating.
Evaluate conversations on close.
Logging
Application logs record operational identifiers — workspace IDs, team IDs, the installer's email address, plan names, and conversation IDs — for support and debugging. Conversation message bodies and customer contact details are not written to application logs.
A decision record that outlives the thread.
The Approvals workflow turns an informal Slack conversation into a retained decision record. An agent raises a request from the Supportman app inside the Intercom Inbox — a refund, a discount or credit, a policy exception, or an escalation — and it is posted as a card into a dedicated Slack approvals channel for an authorised approver. Approval records are not editable through the product UI once a decision is recorded.
Retained on every approval
- The originating Intercom conversation and contact
- The requesting teammate's Intercom identity
- The request type and the free-text detail supplied by the requester
- The final status — pending, approved, denied, or cancelled
- The Slack identity of the approver who made the decision
- The approver's free-text decision comment, where given
- The decision timestamp
- A reference to the originating Slack approval card
On approval or denial, Supportman posts a note onto the Intercom conversation recording the outcome, the approver, and their comment. That is what makes the workflow a compliance artifact rather than an internal convenience — the decision trail lives inside the customer record an auditor or internal reviewer already pulls, and it survives Slack message retention limits. Related reading: audit trail for refunds and credits.
Supportman is a data processor.
You remain the data controller for the conversation content, contact records, and teammate records that Supportman reads from your Intercom workspace. A GDPR Article 28 Data Processing Agreement is available on request for Enterprise plans — email us and we will return a signed copy. Because all Supportman infrastructure is hosted in the United States, transfers of EU or UK personal data rely on the Standard Contractual Clauses incorporated into the DPA.
Covered by the DPA
- Processing only on documented instructions from the controller
- Confidentiality obligations on personnel with access
- Security-of-processing commitments (Article 32)
- Subprocessor disclosure and prior notification of changes
- Assistance with data subject rights requests
- Deletion or return of personal data at the end of the engagement
- Standard Contractual Clauses covering EU/UK to US transfers
These are the processor obligations operators are required to flow down to their vendors, including under UKGC LCCP, MGA, and EU AML regimes.
Deleted within 30 days of uninstall.
Operational data — conversations, ratings, evaluations, approvals, and team records — is retained for the life of the account so that historical reporting and audit trails remain intact.
On uninstall, the workspace is marked as uninstalled and Supportman stops processing new data for it immediately. Associated customer data is scheduled for deletion within 30 days.
On request, we will delete a workspace's data ahead of that window. Email [email protected] from an address associated with the account.
Supportman does not modify or delete data in your Intercom workspace, so deletion of Supportman's copy does not affect your system of record.
What we are building next — and what we do not claim yet.
Everything above this section is running today. Everything below it is not, and we would rather say so plainly than let a security questionnaire discover it later.
Continuous automated penetration testing
PlannedAutomated surface monitoring that probes the live application and its APIs with simulated attacks on every deployment, plus AI-generated pentest reporting suitable for handing to a reviewer. We run the code-side scanners today; the dynamic testing layer is the next addition.
SOC 2 Type II
Demand-drivenSupportman does not currently hold a SOC 2 attestation. Our assessment is that for the operators we serve, the artifacts that actually gate a deal are a signed Article 28 DPA, a defensible audit trail for decisions affecting customer funds and policy, subprocessor transparency, and clear data residency — all documented above and available today. We will pursue SOC 2 Type II when customer requirements make it the binding constraint, so tell us if it is a hard procurement gate for you.
Runtime application protection
Under evaluationAn in-application firewall blocking injection attempts and enforcing per-tenant API rate limiting at runtime, complementing the pre-merge scanning already in place.
In the interim, we complete standard security questionnaires and vendor assessment forms on request.
If you believe you have found a security vulnerability in Supportman, report it to [email protected]. Please include enough detail to reproduce the issue — affected endpoint or feature, the steps taken, and the observed impact. We will acknowledge your report and keep you updated on remediation.
Please do not disclose the issue publicly until we have had a reasonable opportunity to address it. We will not pursue legal action against researchers acting in good faith who report through this channel and avoid privacy violations or service disruption while testing.
Questions that come up in vendor assessments.
Where is Supportman data stored?
All Supportman data is stored and processed in the United States. Application servers run on Heroku (AWS) in us-east-1 (N. Virginia) and the primary database is MongoDB Atlas (AWS) in us-west-2 (Oregon).
Is Supportman SOC 2 certified?
Not yet — it is on the roadmap and demand-driven. We have prioritised a signed Article 28 DPA, a defensible decision audit trail, subprocessor transparency, and clear data residency, all available today. We will pursue SOC 2 Type II when customer requirements make it the binding constraint, and we complete standard security questionnaires and vendor assessment forms on request.
How do you keep dependencies patched?
Open-source dependencies are continuously scanned for known CVEs and malicious packages, and Dependabot opens grouped update pull requests weekly for both application packages and CI actions. Our CI pipeline rejects any build carrying a high-severity dependency vulnerability, so a known-vulnerable package cannot reach production through a normal merge.
Do you run penetration tests?
We run continuous static analysis, secrets detection, and dependency scanning across the codebase today. Automated penetration testing — surface monitoring that probes the live application and APIs on every deployment — is planned rather than live, and we would rather say so than imply coverage we do not have.
Does Supportman send our conversations to an AI provider?
Only if you turn AI evaluations on. The setting defaults to NONE, in which case no conversation content is sent to OpenAI or Langfuse. When enabled, conversation content is transmitted to OpenAI for evaluation and to Langfuse for prompt management and tracing.
Can Supportman reply to our customers or change our Intercom data?
No. Supportman reads from Intercom and writes to Slack. The only thing it writes back to Intercom is a decision note on an approval outcome. It cannot reply to customers, close, snooze, or reassign conversations, or delete anything in Intercom.
What happens to our data if we uninstall?
The workspace is marked as uninstalled and Supportman stops processing new data for it immediately. Associated customer data is scheduled for deletion within 30 days. We will delete ahead of that window on request — email [email protected] from an address associated with the account.
Can we get a Data Processing Agreement?
Yes. Supportman acts as a data processor and a GDPR Article 28 Data Processing Agreement is available on request for Enterprise plans. Email [email protected] and we will return a signed copy.
Send us the questionnaire.
We complete standard security questionnaires and vendor assessment forms, and return a signed Article 28 DPA for Enterprise plans. Email [email protected] and we will turn it around.