Administration and security FAQ

Answers about running Hark safely.

Who can configure the workspace?

Owners and admins configure everything. Agents work conversations, live chats, and the customer-facing content surfaces (help center, changelog, work boards) and can view analytics, but they cannot change workspace configuration like routing, SLA policies, boards, or status components. Viewers are read-only. See Roles and permissions.

What is the primary owner and why does it matter?

Exactly one member is the primary owner. On top of full access, they are the only member who can delete the workspace or transfer the primary ownership. This prevents any other owner or admin from removing the account out from under the team.

Can a team member see another workspace's data?

No. Every record is scoped to its workspace, and every permission check includes a cross-workspace guard, so no principal can act or read across organizations. This isolation applies uniformly to the copilot and every AI feature too.

Are custom roles a way to restrict access?

Custom roles add permissions on top of a member's coarse role; they grant capability rather than take it away. Use the four built-in roles to set the baseline and custom roles to grant specific extra abilities.

How are credentials and API keys stored?

Integration credentials and AI provider API keys are encrypted at the application layer before they are stored. The chat widget's public key is public by design (it only identifies which widget is loading), while any signing secret used for verified identity stays server-side and is never exposed to the browser.

Can I export my analytics data?

Viewing the analytics dashboard is open to agents. Exporting the underlying data is reserved for admins and owners.