TicketZero handles sensitive IT operations — password resets, account unlocks, access changes — for firms where a breach is a compliance event, not just an outage. Here's exactly how the system is built.
Every customer is a separate tenant. Data segregation is enforced at the database query layer — every query is scoped by tenant_id. There is no shared data pool between organizations.
Google Workspace OAuth tokens are never stored in plaintext. Encryption uses AES-256-GCM with per-record IVs.
TicketZero requests the minimum Google Admin SDK scopes required to do its job. No broad directory access, no Drive, no Gmail. The OAuth consent screen shows exactly what's requested.
TicketZero does not request access to Gmail, Drive, Calendar, Groups, Org Units, billing, or domain settings. If a future feature requires additional scopes, we will disclose them explicitly before any customer is asked to re-authorize.
Every automated action TicketZero takes against your Google Workspace is recorded with a full, immutable audit trail.
When TicketZero resets a user's Google password, it always sets the change on next login flag. This is not configurable off — it's a security default baked into the resolution flow.
We serve firms in regulated verticals. Here's an honest assessment of where we stand relative to common compliance frameworks.
| Framework | Relevance to TicketZero | Current Status |
|---|---|---|
| GLBA | Applies to CPA and financial advisory firms. Requires safeguards on systems that access client financial data. TicketZero manages IT access controls (passwords, accounts) — these are GLBA-relevant systems. Encryption at rest, access logging, and least-privilege scoping are designed to support GLBA Safeguards Rule compliance. | Architecture sound |
| SOX | Applies to public companies and their auditors. IT access controls and change logs are in scope for SOX IT General Controls. TicketZero's audit trail supports evidence collection for access control reviews. | Audit trail in place |
| HIPAA | Applies to covered entities and business associates. TicketZero processes employee IT requests, not patient data — and does not act as a BAA-covered entity in the standard deployment. Firms in this space should consult counsel on TicketZero's role in their BAA chain. | BAA on roadmap |
| SOC 2 | Trust service criteria covering security, availability, and confidentiality. Encryption, access controls, logging, and incident response processes described here are aligned with SOC 2 Security criteria. Formal audit has not been initiated. | Audit planned |
We don't keep your data after the relationship ends.
If we detect or are notified of a security event affecting your tenant, here's the process:
Compliance teams are welcome to request a security review call. We'll walk through the architecture, answer questions, and share our current controls documentation.