Plan requirement
| Subscription | Any plan |
| Access | Admin |
Most exposure comes from ordinary working habits rather than from settings. Four that make the largest difference.
One: stop collecting what you do not need
Every field on a form is data you now hold and must protect. A date of birth collected because it seemed useful is a liability with no benefit.
Go through your forms once and remove what nobody reads.
Two: tell customers what not to send
People send passwords, identity documents and full card numbers because they are trying to help. A line on the form asking them not to prevents more exposure than any redaction rule.
Three: redact as you go
When something sensitive arrives, remove it from the ticket then, not in a quarterly cleanup. Make it a normal part of handling rather than a project.
Automatic redaction of card numbers is worth switching on regardless. It is Redact credit card numbers, in the Redaction section of Account > Security > More settings. Know its limits before you rely on it: it leaves the first six and last four digits, it does nothing about numbers already in your account, and it cannot be combined with redaction suggestions. It also needs Suite Growth or higher, or Support Professional; the other three points on this page work on any plan.
The fourth limit is the one that matters most. Detection is a heuristic, not a guarantee: Zendesk recognises card numbers by their length and prefix and by a checksum, skips things that look like phone numbers or web addresses, and says plainly that it will neither catch every card number nor spare every number that is not one. Treat it as a safety net under the habit, not as a reason to stop looking.
Four: narrow who can see everything
Ticket access has four levels: All tickets, Tickets in agent's groups, Tickets in agent's org and Assigned tickets only. All tickets is convenient and means one compromised account exposes the lot. On Enterprise the level comes from the custom role rather than from the profile, so that is where to look.
The habit that beats all four
Offboard the day somebody leaves. An active account belonging to a former colleague is a route to a real incident that no setting compensates for.
Exports are the quiet leak
A spreadsheet of tickets on somebody's laptop is outside every control you have configured. Agree where exports may live and who may make them.
Where the obligations come from
What you must do is set by law and by your own agreements, not by the product. If you are unsure how that applies to your setup, ask pluscloud support and we will go through it with you.
Comments
0 comments
Article is closed for comments.