Agent Status Automation by Playlist updates agent statuses automatically, which requires access to your Zendesk account through the Zendesk API. This article describes what the app accesses, what it stores, and how Playlist protects your data.
Zendesk OAuth scope
Agent Status Automation authenticates with Zendesk using OAuth (see Using OAuth authentication with your application). The app requests the following scopes:
- Read: all – Although this scope allows read access to all data, the app only reads the data listed under Zendesk data the app accesses below. It never reads tickets or end-user data.
- Write: users – Updates agent statuses.
- Write: apps – Updates the app's secure installation settings and sends in-app notifications to admins.
The token is issued on behalf of the Zendesk admin who authorizes the app, and it can be revoked at any time by deauthorizing the app from its OAuth page or in Zendesk Admin Center.
Zendesk data the app accesses
The table below lists all data the app retrieves from your Zendesk account, and whether it's stored in our database.
| Data | Details | Stored |
|---|---|---|
| Agents and admins | User ID, name, role, whether their Zendesk account is active, default group, and time zone. Only users with an agent or admin role are retrieved. | Yes |
| Group memberships | User IDs and group IDs, used to determine which statuses each agent can use. | Yes |
| Agent status definitions | The statuses configured in your account: status ID, name, channels, and group restrictions. | Yes |
| Status update results | For each status the app sets: the agent's user ID, the status, and whether the update succeeded, with Zendesk's error message if it didn't. | Yes, in the activity log |
| Schedules and holidays | Schedule name, time zone, hours, and holiday names and dates. Only retrieved when an admin imports them from Zendesk. | Yes |
| Account and app installation | Subdomain, plan, whether the account is a sandbox, and the app's installation ID, name, and access restrictions. | Yes |
| Authorizing admin | User ID, name, email address, and role, used to send operational alerts. | Yes |
| OAuth tokens | Access and refresh tokens, scopes, and expiry. | Yes, encrypted |
Our server doesn't read or store agents' current statuses; it only sets them. For the online prompt, an agent's current status is checked in their own browser and isn't sent to our server.
The app never accesses tickets, ticket comments, attachments, conversations, or end-user (customer) data.
Because Agent Status Automation updates statuses even when no one is signed in to Zendesk, it must store your OAuth tokens. They're encrypted on our server before they're written to the database and are never exposed to users in the browser.
Data encryption
All data is encrypted in transit using TLS 1.2 or higher and at rest using AES-256. Encryption keys are managed with AWS Key Management Service (KMS), and OAuth tokens are additionally encrypted at the application level with KMS before storage.
Server location
Our servers are hosted on Amazon Web Services in the US West (Oregon) region, us-west-2. Data is backed up daily to the US East (Ohio) region, us-east-2.
Requests from the app
Requests made from the app inside Zendesk are sent through Zendesk's secure proxy, authenticated with a per-account key stored in the app's secure installation settings.
IP restrictions
Agent Status Automation uses fixed IP addresses, so you can enable IP restrictions in Zendesk if your security policy requires them. Contact us for the current list of IP addresses.
Multi-factor authentication
Multi-factor authentication is enabled and enforced on all of our systems. We use Google Authenticator, with SMS as a fallback.
Questions about security or data handling? Contact us at support@myplaylist.io.