Auto Secure LoginOne encrypted ticketing engine for every app you run.
ASL Tickets is a shared, multi-tenant support and work-request service any ASL product drops in with a single script tag. It cleanly separates intra-org tickets from ASL-support tickets. Each consuming app keeps its own login; its backend mints a short-lived, tenant-scoped token so the browser never touches a service credential. Ticket bodies and comments are encrypted at rest — never logged, never emailed, never in a URL.
The problem
Every app rebuilding ticketing is every app leaking it.
When each product grows its own support inbox, each one re-invents auth, storage, and notifications — and each one is a fresh chance to log a customer's sensitive message, email it in the clear, or expose it to the wrong tenant.
ASL Tickets is one hardened engine every app shares: bodies encrypted at rest, a hash-chained audit, strict isolation, and a loopback-only admin surface — so no product has to get ticketing security right on its own.
Credentials never reach the browser
- The consuming app's backend mints the token
- Tokens are short-lived, scoped app + org + user + role
- The browser never holds a service credential
- Admin API is loopback-only
Capabilities
A support backbone, not a support silo.
Two tenancy boundaries
Intra-org tickets and ASL-support tickets are separated, so a customer's internal queue never mixes with platform support.
Drop-in widget
A widget served from /client.js that mounts into any app — a constructable stylesheet keeps it working under a strict CSP.
Scoped HMAC tokens
Short-lived tokens scoped to app + org + user + role, with a custom compact JWT verified in constant time.
Encrypted bodies
Ticket bodies and comments are AES-256-GCM at rest — and never appear in logs, emails, or URLs.
Full lifecycle
Status, priority, and assignment, all role-gated, across the ticket's life.
Cross-org support queue
An ASL support queue spans products for a unified view in Command Center.
Attachments as pointers
Files are referenced as pointers (backed by ASL Files), never stored as bytes inside a ticket.
Minimal-disclosure email
Notifications via the shared gateway carry only a subject and an ID — never the encrypted body.
Hash-chained audit
A tamper-evident audit over the ticket lifecycle, with fire-and-forget notifications that can't block the request.
Add support once. Everywhere.
An embeddable, encrypted, isolated ticketing engine with a hash-chained audit — one script tag, no service credential in the browser.