It closes tickets. It asks first.

SOC 2 Type II

GDPR

CCPA

SSO and SCIM

Audit log export

Mesa asks before anything risky

Every playbook is marked safe or risky when you write it. Risky actions stop and post their plan in the ticket thread, and a named person has to approve before anything moves. There is no setting that turns that off.

Scopes are the narrowest that still work

The Slack, Zendesk and Salesforce apps ask for the smallest set of permissions that lets a playbook run. If a playbook does not need write access, the token it uses does not have it.

Your data stays in your tools

Mesa reads tickets to decide what to do and writes back the result. It does not build a copy of your helpdesk. Ticket bodies are held for ninety days for the audit log, then deleted.

No training on your data

Tickets, playbooks and approvals are excluded from model training, by us and by every vendor we use. That is a clause in the order form, not a line on a web page.

Encryption and keys

TLS 1.3 in transit, AES-256 at rest. Integration tokens are encrypted with keys held in a hardware security module, and once saved they are never displayed again or logged.

Every action is logged

What ran, what it changed, who approved it and which ticket it touched. Exportable as CSV or streamed to your own store, kept as long as your retention says.

Certifications and reviews

Audited against SOC 2 Type II once a year by an outside firm. The full report and the latest penetration test summary go out under NDA. We answer security questionnaires in five working days.

Send us the questionnaire.

security@mesahq.app goes to an engineer, not to a queue. Questionnaires come back in five working days and the SOC 2 report goes out under NDA the same day you ask.