These measures form Annex II of the DPA. They describe the safeguards Screendesk commits to maintain for Customer Personal Data, proportionate to the risks and the purchased service. A signed security schedule takes priority where agreed. We may improve or replace measures without materially reducing overall protection during the term.
1. Governance and assurance
Screendesk has completed a SOC 2 Type II audit. We use Comp AI to support compliance management, policies, evidence collection and our Trust Center. The independent auditor, rather than the compliance platform, issues the audit report. Request available assurance documents and confirm the report's scope and observation period through the Trust Center.
We maintain documented security, privacy, access, incident, retention, backup, change and supplier-management policies, with periodic review. An audit addresses its stated scope and period; it is not a promise that a service can never experience an incident or a general certification of every customer's use.
2. Access and confidentiality
Access to production systems and personal data is limited by job responsibility and least privilege. We use individual identities, protect privileged credentials, review access, and revoke access when no longer required. Multi-factor authentication is required for privileged administrative access where supported. Personnel handling Customer Data are bound by confidentiality duties and receive security and privacy awareness training.
Access for support or investigation must have a legitimate purpose and be limited to what is needed. Customer workspace roles and available identity controls support customer-managed access; plan-specific SSO or provisioning features are not implied to be included in every subscription.
3. Encryption and infrastructure
We use encryption in transit over supported network connections and encryption at rest for production data stores and backups using provider-supported controls. Keys and secrets are protected against unauthorized access. We select infrastructure providers with appropriate security safeguards and restrict administrative exposure.
Transport and storage encryption are distinct from end-to-end encryption. Server-side transcription, processing and playback can require authorized systems to decrypt content. We do not describe all Screendesk recordings or calls as end-to-end encrypted.
4. Secure development and monitoring
We use access-controlled source repositories, review and change processes, dependency and vulnerability management, and separation of development and production access. We assess and remediate findings according to risk. Security-relevant logs and monitoring support detection and investigation, with access and retention controls. We review third-party security assessments and conduct application security assessments appropriate to the service.
We minimize personal data in operational diagnostics where feasible. Error logs and support information can still contain personal data and must be handled accordingly.
5. Backup and recovery
Our continuity policy requires daily backups of critical production data, protected backup access and encryption, and documented recovery arrangements with infrastructure providers. Provider-managed point-in-time recovery may form part of those arrangements. We maintain and review continuity procedures and perform risk-appropriate recovery validation.
Internal recovery targets are operational objectives. A contractual recovery time or recovery point objective applies only when expressly agreed in your signed agreement. Backup retention does not give us permission to retain data indefinitely; deletion follows the DPA and any applicable signed schedule.
6. Incident handling
We maintain procedures for reporting, triage, containment, investigation, recovery and review of incidents, with assigned responsibilities and escalation paths. Personal-data breach notifications follow the DPA's without-undue-delay obligation. Service availability and credit remedies are covered separately by our SLA.
7. Supplier and data lifecycle controls
We assess suppliers in relation to the data and service they handle, limit disclosure to assigned purposes, and require appropriate contractual obligations. Subprocessor changes follow the DPA's notice and objection process. Customer-controlled integrations are separately authorized by the customer.
We apply data minimization, retention and secure disposal requirements, support export and deletion, and restrict residual backups and legally retained records. International processing must have a lawful transfer basis; a SOC report alone is not that basis.
8. Shared responsibilities and review
Customers should restrict workspace access, protect credentials and devices, configure sharing and retention, and collect recordings lawfully. Share only what is needed, and review AI outputs and integration permissions. These customer responsibilities do not replace Screendesk's obligations.
For a questionnaire, report access, specific residency requirements or details supporting an assessment, visit trust.screendesk.io or contact support@screendesk.io. Sensitive reports may require confidentiality protections. Audit rights remain governed by the DPA.