Privacy Policy

Account and organization information. When you or your organization sign up, we collect your name, work email address, organization/company name, and role within your account (e.g. root/administrator or staff). If you sign in with Microsoft, we receive your name, email, and Microsoft tenant ID from Microsoft's own sign-in flow.

Endpoint and machine data. The RemediateDesk agent, once installed on a machine by you or your organization, reports operational telemetry back to our servers: hostname, operating system and version, CPU/memory/disk usage, running service status, pending updates, and similar system health metrics. This data describes the state of the machine, not its user's personal activity.

Diagnostic and command data. When our AI diagnoses an issue on a machine, it may read system logs, configuration files, running-process lists, or similar diagnostic output from that machine in order to propose a fix, and it records the commands it proposes and runs along with their output. This diagnostic content can incidentally include information present on the machine itself - for example, a file path containing a username, or an error message that includes a machine or network identifier. We do not intentionally collect employee personal data through this channel; it is a byproduct of diagnosing IT problems, and access to it is limited to what your organization's own approval settings and personnel choose to expose.

Chat and support conversation history. Messages you send to the AI assistant or to RemediateDesk support, and the AI's responses, are stored so your team can review past diagnoses and so the assistant can maintain context within a conversation.

Third-party integration data. If you connect Autotask (our PSA integration), ConnectWise RMM or Automate, or Microsoft 365, we access and store the minimum data needed to operate that integration - for example, ticket subject/description/status for Autotask mapping, device inventory from ConnectWise, or a Microsoft 365 admin-consented ability to manage users/groups/licenses via the Microsoft Graph API. Credentials for these integrations are stored encrypted and never in plain text.

Website analytics. Our public marketing website (remediatedesk.com) uses Google Analytics to understand aggregate visitor traffic. This does not run on the dashboard application, the admin console, or any customer endpoint.

Payment information. If and when RemediateDesk begins processing payments directly, billing details will be handled by a PCI-compliant third-party payment processor, and we will not store full payment card numbers ourselves.

• To provide the Service: diagnosing and remediating issues on machines you've enrolled, at your direction and subject to your organization's approval settings.
• To operate AI-driven diagnosis: diagnostic data described above is sent to our AI model provider (see "Third parties" below) solely to generate a diagnosis or proposed fix for that specific request.
• To maintain and secure the Service: monitoring for abuse, debugging real incidents, and preventing unauthorized access.
• To communicate with you: service notifications, security alerts, and, if you've agreed to receive them, product updates.
• To improve the Service: understanding aggregate usage patterns (e.g. which categories of issues are most common) to prioritize future development.

We do not sell your personal information or your organization's diagnostic data to third parties, and we do not use your organization's endpoint/diagnostic data to train AI models for use by other customers.

We rely on a limited set of service providers (subprocessors) to operate RemediateDesk:

• Amazon Web Services (AWS) - hosts our infrastructure, including the database, compute, and device-connectivity services that store and process all Service data.
• Anthropic - processes diagnostic requests (via AWS Bedrock) to generate the AI's analysis and proposed commands. Only the specific diagnostic content relevant to the request in progress is sent.
• Autotask - only if you connect the Autotask PSA integration, to read ticket data and post internal notes for machines you've explicitly mapped. ConnectWise RMM and Automate - only if you connect them, to import device inventory and deploy the agent.
• Microsoft - only if you connect Microsoft 365 or use "Sign in with Microsoft," via Microsoft's own Graph API and identity platform, under admin consent your organization grants directly to Microsoft.
• Brave Search - receives only the search query the AI writes when it runs an optional web lookup, for example to find a vendor's official download page. It never receives machine names, command output or credentials.
• Google Analytics - marketing website traffic only, as described above.

We may also disclose information if required by law, to enforce our Terms of Use, or to protect the rights, property, or safety of RemediateDesk, our customers, or others.

We keep each kind of data only as long as it is useful to your team, then delete it automatically. The periods below are the ones actually enforced by the Service today (they are configured in our systems, not just stated here); if we change one, we'll update this page and the effective date above.

Deleting a machine or closing your account removes the associated active records immediately; the time-limited items above then age out of backups on the 35-day schedule.

Each managed endpoint connects to our infrastructure using a unique, mutually-authenticated device certificate (mTLS) - one machine's connection cannot be used to impersonate another. Integration credentials and other secrets are stored encrypted at rest, never in plain text. Commands that change a machine's state are classified by risk before they run, and anything above a safe/read-only tier requires a human's explicit approval unless your organization has deliberately configured a machine to auto-run them. No method of transmission or storage is 100% secure, but we work to protect your information using industry-standard safeguards appropriate to the sensitivity of the data involved.

You can review, export, or delete your organization's data at any time from within the dashboard, including a full account-deletion option that removes your offices, machines, users, and associated records. If you'd like help with a data request beyond what the dashboard supports directly, contact us using the details below. Depending on where you're located, you may have additional rights under laws such as the GDPR or CCPA, including the right to access, correct, or request deletion of your personal information.

RemediateDesk is a business-to-business IT operations tool and is not directed at, or intended for use by, individuals under 18. We do not knowingly collect personal information from children.

We may update this Privacy Policy from time to time. If we make material changes, we'll update the effective date above and, where appropriate, notify account administrators directly.

Questions about this Privacy Policy or your data can be sent to privacy@remediatedesk.com.