SLA & Change Analytics security

Product-specific security information for FS2 for Freshservice, last updated 23 October 2026. Coming soon: public installation and purchase are unavailable.

Shared API access

The Freshworks platform 3.0 app uses a configured Freshservice subdomain and API key. All viewers share that key's access scope. Restrict app visibility to authorized reporting users and use an appropriately limited key. This is not per-viewer authorization against each person's own Freshservice permissions.

The settings browser handles the key during entry and verification. The saved key is marked as a secure installation parameter and used in request-template authorization headers. Do not send it to support. Rotate or revoke it through Freshservice when needed.

Report filtering and its boundary

The reporting functions make read-only ticket and change API requests. They filter upstream responses to operational IDs, status and group IDs where applicable, timestamps, pseudonymous agent labels and outcome categories. Dashboard payloads and exports exclude names, email addresses, subjects and descriptions. The app does not fetch a contact directory or activity text, or modify tickets and changes.

Raw upstream responses may contain personal data. Installation verification invokes verifyCredentials in the settings browser and can return a raw sample ticket response, although the page only checks success. Request templates declared in the manifest can also be browser-callable. Report projection is not a universal boundary preventing browser access to raw personal fields. Pseudonymous labels can still be linked to people.

Hosting, storage and exports

Freshworks hosts the app, serverless functions and key-value storage. There is no external app reporting backend or telemetry integration. Reports stay in page memory; saved view configuration uses browser local storage. Minimal ticket status events are retained in Freshworks storage, up to 120 events for 90 days per ticket with a 90-day TTL. Missing events or concurrent writes can leave gaps. Immediate deletion after ticket removal or uninstall is not promised.

CSV and Excel-compatible SpreadsheetML .xls downloads contain operational IDs and metrics. Formula prefixes and XML markup are escaped; this does not remove the need to protect the files. The Excel format is not native .xlsx and may show a warning. See the product privacy page for platform retention, preferences and downloaded files.

Reporting and verification limits

Reports cover a created-date cohort of up to 93 inclusive UTC days. Sequential reads of up to 300 pages per resource are not an atomic snapshot. Caps, cancellation, API failures and missing fields can reduce coverage. SLA comparisons do not reconstruct native pauses or policy history, and weekly UTC hours exclude holidays and daylight-saving rules.

Hosted tenant behavior, cloud SDK handshake, event delivery, plan compatibility, Marketplace acceptance and billing remain unverified. Local synthetic checks do not establish production acceptance. No security certification, third-party audit or Freshworks endorsement is claimed.

Report a vulnerability

Email support@atesensoftware.com with the app name, sanitized impact and reproduction steps. Do not include customer records, raw API responses, report exports, passwords or API keys. We aim to acknowledge every support email within two business days (Europe/Istanbul).

See the publisher security policy. The publisher is individual developer Samet Atesen, using the Atesen Software name.