Support and billing operations

Dashloom separates product support records from payment mutations. Workspace owners submit billing questions, cancellation feedback, and refund-review requests in Settings. Each request receives a reference ID and starts in new status.

Configure operators

Set a comma-separated allowlist in the hosted deployment:

DASHLOOM_OPERATOR_EMAILS=billing@example.com,founder@example.com
AUTH_REQUIRE_EMAIL_VERIFICATION=true

Only an authenticated user whose verified account email exactly matches the normalized allowlist can open /dashboard/operator or call /api/operator/support. Unauthorized requests receive a generic not-found response. Keep the list short, use accounts with strong authentication, and remove access immediately when duties change.

Operators can mark a request reviewed or closed and add a resolution note visible to the workspace owner. Every update records the operator user ID and a workspace audit event. Dashloom does not issue a refund, cancel a subscription, or alter an invoice from this queue; those actions remain explicit, authorized work in Stripe.

The same console includes an automation ledger for scheduled and authenticated manual maintenance. Use it to spot an incomplete quarter-hourly or daily batch before investigating the corresponding domain-specific sync, report, billing, or retention records. Stored task summaries use stable codes and exclude raw provider errors and payloads.

Public response levels

• Active service incident: publish current reachability at /status; acknowledge confirmed critical hosted incidents as soon as operationally possible.
• Billing, cancellation, and refund review: target an initial human review within two business days.
• Security vulnerability: use the private process in SECURITY.md, not product feedback.
• Community setup and feature requests: best effort through the public repository.

These are operating targets, not contractual service-level guarantees. A hosted operator must publish its legal entity, business hours, refund policy, support contact, incident history, and any contracted SLA before accepting production payments.

Never paste card data, credentials, private connector payloads, or authentication tokens into a support note.