Ticketing, a help center, live chat and AI that answers only from your knowledge. Open source. Self-hosted. In English and Arabic.
Free under AGPL-3.0Docker ComposeOne install, every brand
Every conversation. One desk. Email, WhatsApp, Messenger, Instagram, Telegram, the chat widget, a web form and the API all file into the same tickets, with the same statuses, SLAs, rules and assignment.
POST /api/v1/ticketsEach brand connects its own accounts. A reply goes back on the channel the customer wrote from.
Helpdock 1.0 · 20 October 2026
Every milestone of the 1.0 plan has shipped. Before release: an external pentest of the widget and the API, a load run, a screen-reader pass, an onboarding run with three outside testers and a restore drill.
Watch on X · 1:09
1.0.1 is the latest release. It binds Google and GitHub sign-in to the provider account, refuses a CAPTCHA solved on another site, and fixes mixed-direction text in the Arabic admin. Upgrading from 1.0.0? Some Google and GitHub sign-ins must be connected again: read the release notes.
A help center, a chat widget, SLAs, rules, reports and sign-in, in the one install.
Articles in English and Arabic, search in each language and "was this helpful?" feedback. Public and internal articles, so the same knowledge serves customers and staff.
Image: a render of the help center's design artboard.
Live over WebSocket, with optional signed identity for signed-in users. Its first script is held to a 40 KB gzipped budget.
Image: a render of the widget's design artboard.
Argon2id passwords checked against a breached-password list, a second factor that Admins must use, and magic links. SAML 2.0 and OpenID Connect, with walk-throughs for:
Business hours with holidays and time zones. Clocks pause in the statuses you mark as paused. A CSAT survey goes out when a ticket is closed.
Workflow and time-based rules with a test run and an execution log. Macros with placeholders. Saved views, merge and split, and a collision indicator.
Volume, response times, SLA compliance, CSAT and workload, with CSV export. A REST API with scoped keys and an OpenAPI document. Webhooks signed with HMAC.
Grounded AI
The assistant answers customers and helps agents from the brand's own knowledge base. When that does not answer the question, a person does.
Help center articles, PDF and DOCX files, crawled websites, Notion and Google Drive. Visitor-facing answers read only public knowledge.
Any citation that does not resolve to a document it retrieved is dropped.
When the knowledge base does not answer, or confidence is below the channel's threshold, your team takes over.
The model has no tools. PII is redacted and a prompt-injection filter runs before each call. Every call is logged with its cost, and budgets cap each brand.
glm-4.6 answering, glm-5.1 judging, bge-m3:567m embeddings, in run 39322685646. That is one provider pair: evaluate the model you choose. Suggested replies, summaries, translation, AI triage and voice-note transcription are there too. Every AI mode is off until a brand's Admin turns it on.
Bilingual
The admin app, the help center, the chat widget and the emails ship in both languages, with right-to-left layouts.
The widget image is a render of its design artboard. اقرأ هذه الصفحة بالعربية
Multi-brand
Every brand runs from the one install, each with its own face and its own data.
ALTER TABLE "telegram_bots" ENABLE ROW LEVEL SECURITY;
ALTER TABLE "telegram_bots" FORCE ROW LEVEL SECURITY;
CREATE POLICY "telegram_bots_tenant_select"
ON "telegram_bots" FOR SELECT
USING (brand_id = ANY (
nullif(current_setting('app.brand_ids', true), '')::uuid[]
));brand_id under a forced row-level security policy like this one, and the api refuses to serve if its database role could bypass it. Postgres keeps brands apart, not only application code.Security
The rules are written down, the code is open, and every release image is signed.
Every tenant table is under a forced Postgres policy by brand, with department scope on ticket data.
AES-256-GCM under a master key that is not stored in the database. Secrets are never returned after they are saved.
Every fetch of a user-supplied URL goes through one client that blocks loopback, private and cloud-metadata addresses and re-checks every redirect.
Sniffed by magic bytes, re-encoded, kept in a private bucket and served through short-lived presigned URLs.
All 258 requirements of ASVS 4.0.3 Level 2 walked one by one, with the evidence named and no gap open.
Each release image is signed keylessly with Cosign and published with a CycloneDX SBOM.
Read the security guide, the ASVS walk-through and how to verify the image signature. Report a vulnerability privately, as SECURITY.md describes.
Migration
A bilingual import wizard brings your history across. A manual CSV mapper covers every other tool.
Pick the source and connect the account, or upload an export for the CSV mapper.
Departments, staff, statuses, priorities, channels, tags and custom fields, with saved presets.
Compare expected counts and inspect replies, notes, authors, dates and files before anything is written.
Start the reviewed run, watch its log, and pause or resume it.
Imported history sends no customer messages and starts no rules, notifications or SLA timers.
The importers were verified against stand-in servers built from each vendor's published API documentation, not against live accounts. Importing guide
Quick start
One Docker Compose stack on your own Linux server. You need:
git clone --depth 1 --branch v1.0.1 \
https://github.com/Docker-Hunterpedia/Helpdock.git
cd Helpdock/docker
cp ../.env.example .env
openssl rand -base64 32 # the master key, for APP_MASTER_KEY2. Edit .env: set HELPDOCK_VERSION=1.0.1 and at least
APP_URLAPP_MASTER_KEYHELPDOCK_APP_PASSWORDDATABASE_URLPOSTGRES_PASSWORDDATABASE_MIGRATION_URLADMIN_HOSTAPI_HOSTACME_EMAILS3_*
docker compose up -d
docker compose ps4. Open https://<ADMIN_HOST> and finish the first-run wizard. Back up .env with the database: without APP_MASTER_KEY, nothing encrypted can be read back.
Roadmap
Proposed releases from the 1.x plan. Nothing in it has started yet, and its contents and order can change.
The full plan is Phase 5 of the PRD.
Nothing. Helpdock is free software under the GNU AGPL-3.0, with no paid tiers or licence keys. If you change it and let people use your changed version over a network, the AGPL asks you to offer them its source.
No. Helpdock is self-hosted only: you run it on your server and your data stays there. A hosted Helpdock is a stated non-goal for the 1.x releases.
A Linux server with Docker Engine and the Compose v2 plugin, 2 vCPU and 4 GB of memory (ClamAV, if you turn it on, wants another 2 GB), two DNS names, ports 80 and 443, and an S3-compatible bucket. Docker Compose is the supported runtime.
Any provider pi-ai supports, such as OpenAI, Anthropic, Google, OpenRouter, Groq, Mistral, xAI or DeepSeek, by API key or subscription, or any OpenAI-compatible server such as Ollama or vLLM, so the model can run on your own hardware.
No. Every AI mode is off until a brand's Admin turns it on. The desk, channels, help center and widget work without it.
English and Arabic, with right-to-left layouts, across the admin app, help center, widget and emails. More languages are proposed for 1.3.
Yes, from Zendesk, Freshdesk and Zoho Desk with their importers, and from anything else with the manual CSV mapper. Run the dry run first: the importers were verified against stand-ins, not live vendor accounts.
Privately, as SECURITY.md describes. Please do not open a public issue.
Helpdock is developed by Oday Bakkour, in the open on GitHub. Contributions are welcome; start with CONTRIBUTING.md.
Something else? Write to contact@oday-bakkour.com or start a discussion on GitHub.
Install 1.0.1 with Docker Compose, read the docs, or star the repository to follow the 1.x releases.
Read the docs