Redaction on intake
Card numbers, national IDs, and health details are masked the moment a message arrives.
- Pattern and keyword rules
- Masked for agents without clearance
For regulated industries
Support ticketing built forsecurity and compliance
Run customer support under real controls: single sign-on, audit trails, data residency, and encryption, without slowing your agents down.
Reviewed by security teams in finance, health, and government.
Every action on this queue is written to an exportable audit log.
Regulated queue
3 awaiting approval · 2 redacted
Refund above threshold needs approval
WaitingHighEmailLM18mCard number redacted on intake
OpenNormalChatSD6mAccess review due for vendor account
NewHighForm1hData export request from account owner
OpenUrgentEmailNB2hRetention hold applied to case 4471
SolvedNormalAPIPT4h
Trusted by teams with auditors to answer to
- Meridian Trust
- Halden Health
- Corvus Public
- Brightpad
- Vestra
- Northwind
Placeholder names — swap in your own customers from the dashboard.
Controls
Controls your security teamwill recognize
Single sign-on and provisioning
SAML and OIDC sign-in, SCIM provisioning, and group-to-role mapping, so access follows your directory.
Granular audit trails
Every view, edit, and export is recorded with actor, time, and scope, and the log is exportable.
Data residency and retention
Choose the region your tickets live in and set a retention window per queue.
Encryption and monitoring
Encrypted in transit and at rest, with alerts on unusual access patterns.
Workflows
Workflows regulatedteams need
The steps your policy already requires, built into the queue instead of bolted on beside it.
Approval before refunds
Sensitive actions pause for a second pair of eyes, with the reason recorded.
- Thresholds per team
- Approver noted in the audit log
Signed status pages
Customers get a status link that proves what was said, and when.
- Tamper-evident record
- Expiring links
Retention schedules
Tickets age out on the schedule your policy sets, queue by queue.
- Per-queue windows
- Automatic deletion reports
Legal hold
Freeze a case so nothing is edited or deleted while a matter is open.
- Hold by case or account
- Release requires two admins
Access reviews
Recurring reviews show who can see what, and remove what is no longer needed.
- Quarterly review prompts
- One-click revoke
From teams that passed review
Our auditors asked for six months of access history and we exported it in a morning. Support stopped being the awkward part of the review.
Industries
Built for teams under scrutiny
Three places where a support queue has to answer to more than the customer.
Financial services
Refund approvals, dispute trails, and the retention windows regulators expect.
Healthcare operations
Patient details masked on intake and visible only to cleared staff.
Public sector
Regional hosting, records requests, and a log you can hand over.
Compliance
What security teamsask us
The points that come up in almost every security review.
Yes. Connect any SAML 2.0 or OIDC provider, and use SCIM to create, update, and deactivate agents from your directory. Group membership maps to Caly roles.
You choose the region when the workspace is created, and tickets stay there. Backups stay in the same region.
Every sign-in, ticket view, edit, export, permission change, and approval, with the actor, timestamp, and affected records. It is searchable in the app and exportable as a file.
Yes. Fields can be masked by role, and redaction rules strip values before any agent sees them. Vendors and contractors can be given time-boxed access that expires on its own.
Yes. Ask us for the security overview, the subprocessor list, and current reports, and we will complete a questionnaire if your process needs one.
Next step
Bring support inside your controls
Walk through the controls with our team and see how they map to your policy.
We answer security questionnaires within five business days.