Security and data handling

Last updated: November 13, 2026

Automation Yardstick connects to the systems that run your help desk, so we've kept the access it needs and the data it keeps as small as possible.

Read-only access

• ConnectWise PSA: an API member with inquire-only permissions. It can't add, edit, or delete anything.
• Pia: an API app limited to reading clients and agents. It can't change or run automations.

We recommend changes. Your team makes them, and we confirm them by re-reading the PSA.

What we keep, and what we don't

We keep record IDs, statuses, counts, and timestamps: enough to measure configuration and results. We never store ticket subjects or text, note bodies, computer names, logged-in user names, or Microsoft tenant IDs. Fields we don't need are dropped before anything is saved.

Isolation and access control

• Every record belongs to one customer workspace, enforced in the database itself.
• Sign-up is by invitation only, and workspace admins control who has access.
• Data in the app is read-only to users; only our server-side sync writes it.

Encryption and credentials

• All traffic is encrypted in transit with TLS.
• Data is encrypted at rest by our database provider.
• Integration credentials are stored server-side and are never sent to the browser.

Report a security issue

If you believe you've found a vulnerability, tell us through our contact form. We'll acknowledge it promptly and keep you updated while we fix it.