Join the waitlist

Security

Security at Thorpe

Thorpe sits in the channels where your customers talk to you, so it asks for as little as it can and keeps what it holds locked down. This page covers how. What Thorpe collects, and for how long, is in the privacy policy.

Read the privacy policy Report a vulnerability

Slack scopes
Bot scopes only, never user or admin scopes
Slack events
Every request from Slack is checked against Slack's signature before Thorpe acts on it
Sign-in
The web app has no passwords: you sign in with Slack
Logs, metrics and errors
Written to leave out message text, names, email addresses and tokens

At a glance

Thorpe asks for as little as it can, and keeps what it holds locked down.

Slack scopes

Every Slack scope Thorpe asks for

These are all the scopes the production app requests. Each is a bot scope.

channels:history
Read messages in public channels Thorpe has been added to.
groups:history
Read messages in private channels Thorpe has been invited to.
channels:read
See the name and members of public channels.
channels:join
Join the public customer channels an admin picks during setup.
groups:read
See the name and members of private channels Thorpe is in.
chat:write
Post as Thorpe, for example the triage card.
im:write
Send direct messages, such as teammate alerts and private-request replies.
im:history
Receive messages people send to Thorpe, for private requests.
users:read
See names and profile details of people in the workspace.
reactions:read
See emoji reactions on messages.
reactions:write
Add 👀 to your team's first reply to a request, and in private requests 👀, ✅ and ⚠️ to show a message arrived, was delivered or was not delivered.
team:read
See the workspace's name, email domain and icon.
commands
Required by Slack for message shortcuts such as "Track as request".

Tokens

How tokens are encrypted

Slack tokens, and the tokens for Linear or HubSpot when a workspace connects them, are encrypted before they are stored.

Tokens are never logged, and uninstall deletes them at once.

Cipher
AES-GCM with a 256-bit key
Nonce
A fresh random 96-bit nonce for every encryption
Binding
Each ciphertext is bound to its workspace, so a token copied into another workspace's record will not decrypt
Key
A secret held by Cloudflare Workers, never in code
Rotation
When the key is rotated, tokens sealed with the old key are sealed again with the new one the next time they are read

Isolation

How workspaces are kept apart

Each workspace's requests, messages and settings live in that workspace's own Durable Object on Cloudflare.

Shared database
Behind the web app, it holds a copy for search and reports, and also holds some settings
Queries
Every query against the shared database is scoped to one workspace

AI

How Thorpe uses AI

  • AI is off until an admin turns it on in Settings > AI, under "Smarter request detection".
  • When it is on, it titles new customer messages, sorts them into requests and chatter, and writes short summaries for escalated issues.
  • With AI off, every top-level customer message opens a request and nothing is sent to a model.
Models
Run on Cloudflare Workers AI, in the same Cloudflare account as the rest of Thorpe
Replies
Thorpe never sends AI-written text to a customer. A teammate sends every reply.

Questions

Security questions

Where is data stored?

The live service stores everything on Cloudflare: Workers, Durable Objects, D1, KV and R2. Each workspace's data is kept separate from every other workspace's.

Can Thorpe post in my customer channels?

Only for features an admin turns on, such as the How did we do? rating prompt when a request closes, or messages your team chooses to send, such as a broadcast. By default, the only sign of Thorpe there is the 👀 reaction it adds to your team's first reply. Thorpe never sends AI-written text to a customer. A teammate sends every reply.

What happens when we uninstall?

Uninstall deletes Slack tokens at once and message content within 30 days from the live service. Deleted data can remain in a backup until that backup expires. The privacy policy has the details.

How do I report a vulnerability?

If you find a security problem in Thorpe or usethorpe.com, email security@usethorpe.com with what you found and how to reproduce it.

Get started

Bring your shared channels into one triage view.

Tell us about your team and we will get in touch to set Thorpe up with you.

Join the waitlist