Security and data
How sign-in, second factors and confirmations protect your account, how secrets and company data are kept, how long things are kept, and where our legal documents are.
Signing in
Everyone signs in with a password and a second factor, every time. Passwords need at least 12 characters, and Everdeck checks each new one against known data breaches without sending it anywhere. Second factors are an authenticator app, passkeys, and recovery codes for when you lose your phone or passkey.
On your Profile page you can:
- Change password. Changing it signs out every other session.
- Set up or replace your authenticator app, Add a passkey, and Create new codes for recovery (your old codes stop working at once).
- See Where you’re signed in, Sign out of any session you don't recognise, or Sign out other sessions at once.
- Read your Recent activity: your most recent sign-ins and security changes.
We email you when your account is signed in to from a device we haven't seen recently.
Confirming it's you
Changes that matter ask for your second factor again if you haven't given it in the last 15 minutes: adding or deleting AI keys, connecting apps and changing OAuth apps, changing approval rules, deciding tier 4 approvals, letting an agent run a tier 3 tool without asking, decommissioning agents, deleting recurring tasks, unlinking someone else's Slack account from approvals, changing the plan or the spending cap, giving someone admin or billing access, removing people and transferring ownership. A dialog or page asks for a code or your passkey, then takes you back to what you were doing.
If you lose every second factor
If you still have one factor, sign in with it: another passkey, your authenticator app or a recovery code you haven't used. Then replace the rest on your Profile page.
If you've lost them all, email [email protected] from the address you sign in with. Before we change anything, we check who you are. We write back to that address, and one more check must pass: another owner or admin of your account confirms in writing, or you give us the last four digits and the expiry date of the card your account pays with, and both match.
Then we reset your second factors. Your authenticator app, passkeys and recovery codes are removed, you're signed out everywhere, and your Slack account is unlinked from approvals in every company. Your password stays, and nothing in your account changes. We email you to say it's done, and the reset shows in your account's audit log as Everdeck staff. The next time you sign in, Everdeck asks you to set up a new authenticator app or passkey, and gives you new recovery codes. Keep them somewhere safe.
Secrets
API keys, tokens, passwords for apps and OAuth client secrets are saved encrypted. Once saved they're never shown again, to you or anyone else: pages show only that a secret is saved, or its last few characters. Agents never see them either; Everdeck adds them to each request an agent's tool makes.
Your companies are kept apart
Each company's agents, tasks, documents, files and connections are kept apart from every other company's, in your account and anyone else's. People see only the companies they have a role in (account owners and admins see all of the account's companies), and an agent works only inside its own company. See Companies, members and roles.
What agents may do
Agents act only through the tools their charter grants, each with a risk tier. Anything customers or the public see asks first unless you decide otherwise, money, deletions and access changes always need a person, and timeouts never approve. What agents read from outside your company (emails, web pages, tickets, webhook requests) is treated as information, never as instructions, and their riskier actions after reading it need review. See Approvals and approval rules.
Everdeck staff
If our staff ever change your account or open the content of an agent's session, it's recorded in your account's audit log as Everdeck staff, and in our own staff audit trail with the staff member's reason. See Activity, audit log and sessions.
How long things are kept
Agent sessions, the live feed, notifications and company files are kept as long as your plan keeps session history:
- Starter: 30 days
- Growth: 90 days
- Scale: 365 days
The audit log is kept for 1 year and your sign-in history for 1 year. Usage records (model, tokens and estimated cost, without content) are kept for 13 months, and requests Intake received for 30 days. The data retention policy lists every period.
Legal documents
- Acceptable Use Policy
- Accessibility Statement
- AI Agents and Automated Actions Policy
- Cookie Policy
- Data Retention Schedule
- Data Processing Agreement
- Privacy Policy
- Refund and Cancellation Policy
- Responsible Disclosure Policy
- Security Overview
- Subprocessors
- Terms of Service
To report a security problem, see our responsible disclosure policy or email [email protected].
More in Billing, spending and security
- Billing and plansThe plans and what each allows, your free trial, paying through Stripe, changing or cancelling, and what happens when a payment fails.
- Spending caps and alertsPut ceilings on what agents spend on AI models, per session, per agent and across the account, and get alerts before they're reached.
Still stuck?
Email [email protected] and say what you were trying to do. Or browse every guide.