FlowDesk: Engineering an ITIL-Aligned IT Service Desk & SLA Governance Platform

Most IT teams are one missed email away from a dropped request. We built FlowDesk to fix that: a self-hosted, ITIL-aligned service desk that gives any team a single, auditable system for every ticket, escalation, and SLA target, without the cost or complexity of ServiceNow or Jira Service Management.

The IT Support Problem

If your team manages support requests through a shared inbox, a Slack channel, or a spreadsheet, you already know the pain. Requests slip through. Priorities get confused. And when leadership asks whether service-level targets are being met, no one can answer with confidence.

The tools that solve this at scale come with significant licensing costs and months of implementation effort. For small and mid-size IT teams, that tradeoff rarely makes sense.

FlowDesk was built to close this gap. It is a lightweight, self-hostable alternative that brings structured ticketing, tiered escalation, real-time SLA tracking, and a complete audit trail to any team that can stand up a Supabase project.

What is FlowDesk?

FlowDesk is a full-stack, browser-based IT service desk for internal support teams. It centralizes the entire request lifecycle in one unified interface: intake, triage, tiered escalation, SLA measurement, and resolution.

At its core, FlowDesk is about visibility. A real-time operations dashboard surfaces your open backlog, SLA compliance rate, mean-time-to-resolve, and a live breach watchlist so your team always knows where to focus.

We designed FlowDesk around five request types: Incident, Warranty Claim, Vendor RMA, Access Request, and Security Incident. Each type routes to the correct support team automatically, with type-specific intake fields revealed dynamically at submission so agents never collect irrelevant information.

How FlowDesk Works

1. Submit a Request

Any employee can open a ticket directly from their browser. They select a request type, fill in the fields relevant to that type, and submit. FlowDesk immediately assigns a human-readable identifier (TCK-#####) via a database trigger and stamps an SLA due time based on the ticket's priority and the active SLA policy.

2. Triage and Assign

L1 agents see every new ticket in a unified queue. They review the request, confirm the priority, and assign it to the appropriate support team: IT Support, Asset and Warranty, Identity and Access, or Security. Every assignment is logged to the ticket's timeline with actor identity and timestamp.

3. Escalate When Needed

Complex or specialist work escalates from the L1 front desk to an L2 team. The escalation is recorded as a formal handoff on the ticket's audit trail. L2 technicians pick up the ticket within their team queue and continue from where L1 left off, with the full history visible at a glance.

4. Track and Resolve

The operations dashboard gives managers a live view of backlog trends, agent workload, ticket volume by type, and a breach watchlist sorted by urgency. Once an agent resolves a ticket, the requester can confirm closure or reopen it if the issue persists. Every state change, from creation through closure, is appended to the audit log.

Technical Case Study: Architecture Decisions

FlowDesk is built on the Next.js 14 App Router with TypeScript throughout. Data is fetched in React Server Components and mutated through Server Actions, which also write the corresponding audit events. This keeps all business logic on the server, prevents client-side tampering, and ensures the audit trail is always complete.

The backend is Supabase PostgreSQL, organized around six tables: profiles, tickets, ticket_events, teams, assets, and sla_policies. Referential integrity is preserved with foreign keys, and user deletions use ON DELETE SET NULL so historical tickets survive as records rather than being cascaded away.

One deliberate decision was to enforce authorization at the database layer rather than the UI. We use PostgreSQL Row Level Security with an auth_role() security-definer helper that reads the caller's confirmed role and applies per-table policies. Clearance is reflected in the UI to suppress restricted actions, but the database never trusts what the client reports. This applies least privilege and segregation of duties as database constraints, not as application-level conventions that can be bypassed.

Cancellations are modeled as a soft-delete status rather than row deletion. This keeps the audit trail and aggregate metrics intact. An administrator who needs to remove a ticket for legitimate reasons must take a confirmed, logged action through a dedicated admin path, not a silent delete.

Conclusion & Next Steps

FlowDesk demonstrates that robust IT governance doesn't require massive budgets or complex deployments. It delivers immediate operational visibility and ticket accountability through a streamlined, self-hosted architecture that any small to mid-sized IT team can deploy and own.

The live demo is available at flowdesk.riyadhalmahmud.tech and the full source code is published on GitHub. Whether you're an IT manager evaluating ITSM alternatives, a developer exploring full-stack governance patterns, or a team outgrowing a shared inbox, FlowDesk provides a solid, auditable foundation.