Authentication
Signed Zendesk app requests, account-bound Global OAuth, fresh administrator verification, and read-only scope enforcement.
Implemented in applicationSecurity before scale
A small data footprint with explicit boundaries.
RecordLint is pre-production. This page distinguishes controls implemented and tested in the application from production evidence that still must be completed.
Tenant isolation
Installation-derived tenant identity, explicit tenant predicates, transaction-local context, and forced PostgreSQL row-level security.
Implemented in applicationEncryption
TLS outside local development and AES-256-GCM field encryption with tenant- and purpose-bound associated data.
Implemented in applicationData minimization
Administrator-requested scans only, a maximum 24-hour raw workspace, minimized durable findings, and no persistent raw profile mirror.
Implemented in applicationLogging
A bounded operational metadata vocabulary; raw profiles, contact values, and OAuth secrets are prohibited from logs.
Implemented in applicationDeletion
Disconnect removes credentials and identifying operator data; tenant erasure and hourly retention cleanup are covered by automated tests.
Implemented in applicationBefore public launch
Production evidence still required
- Cloud architecture, least-privilege access matrix, and managed secret/key rotation
- Backup retention, restore test, incident response, and business continuity records
- Vulnerability remediation targets, external security testing, and monitoring evidence
- Final vendor contracts, regions, transfer safeguards, and production DPA
Report a security concern
Email security@recordlint.com. Do not include OAuth tokens, passwords, or real Zendesk end-user data. We will acknowledge a valid report and coordinate remediation privately. Confirmed Customer Data breaches are reported to the affected controller without undue delay and no later than 48 hours after confirmation.