diff --git a/docker-compose.cloud.yml b/docker-compose.cloud.yml
index 0f9bc67b0..e6c845c7d 100644
--- a/docker-compose.cloud.yml
+++ b/docker-compose.cloud.yml
@@ -167,6 +167,14 @@ x-backend: &backend
     # Where replies go when SMTP_FROM is a noreply address.
     - SMTP_REPLY_TO=${SMTP_REPLY_TO:-}
     - SMTP_SECURE=${SMTP_SECURE:-false}
+    # Live support chat (Libredesk). Unset = no widget, no triage webhook.
+    - SUPPORT_CHAT_URL=${SUPPORT_CHAT_URL:-}
+    - SUPPORT_CHAT_INBOX_ID=${SUPPORT_CHAT_INBOX_ID:-}
+    - SUPPORT_CHAT_SECRET=${SUPPORT_CHAT_SECRET:-}
+    - LIBREDESK_API_KEY=${LIBREDESK_API_KEY:-}
+    - LIBREDESK_API_SECRET=${LIBREDESK_API_SECRET:-}
+    - LIBREDESK_WEBHOOK_SECRET=${LIBREDESK_WEBHOOK_SECRET:-}
+    - LIBREDESK_AI_ASSISTANT_USER_ID=${LIBREDESK_AI_ASSISTANT_USER_ID:-}
   volumes:
     # One heap snapshot per process, written by the heap guard when the heap
     # crosses HEAP_SNAPSHOT_PERCENT. A volume so it outlives the container
diff --git a/packages/backend/src/app.module.ts b/packages/backend/src/app.module.ts
index 17f8a2112..b25ccb186 100644
--- a/packages/backend/src/app.module.ts
+++ b/packages/backend/src/app.module.ts
@@ -44,6 +44,8 @@ import { OrganizationsModule } from './organizations/organizations.module';
 import { PublicStatsModule } from './public-stats/public-stats.module';
 import { CloudModule } from './ee/cloud/cloud.module';
 import { LicensingModule } from './ee/licensing/licensing.module';
+import { SupportModule } from './ee/support/support.module';
+import { supportModuleEnabled } from './ee/support/support-config';
 import { getRequiredSecret } from './common/secrets.util';
 import { AppLoggerModule } from './common/logger.module';
 import { SentryContextInterceptor } from './common/sentry-context.interceptor';
@@ -51,6 +53,9 @@ import { SentryContextInterceptor } from './common/sentry-context.interceptor';
 // Determine deployment and auth mode from env
 const useCloud = process.env.DEPLOYMENT_MODE === 'cloud';
 const cloudImports = useCloud ? [CloudModule] : [];
+// Support chat of the instances we operate (Cloud + dedicated enterprise
+// instances); off unless SUPPORT_CHAT_* / LIBREDESK_* are set.
+const supportImports = supportModuleEnabled() ? [SupportModule] : [];
 
 // Determine auth mode from env
 const authMode = process.env.MCP_AUTH_MODE || 'none';
@@ -175,6 +180,7 @@ if (useOAuth) {
 
     // Cloud-specific modules (conditionally loaded)
     ...cloudImports,
+    ...supportImports,
   ],
   providers: [
     // Reports exceptions Nest turns into a 500 response, which otherwise never
diff --git a/packages/backend/src/auth/email-verified.guard.ts b/packages/backend/src/auth/email-verified.guard.ts
index 2b4a8d75d..316e9d605 100644
--- a/packages/backend/src/auth/email-verified.guard.ts
+++ b/packages/backend/src/auth/email-verified.guard.ts
@@ -34,6 +34,8 @@ export class EmailVerifiedGuard implements CanActivate {
     '/api/auth/forgot-password',
     '/api/auth/reset-password',
     '/api/auth/accept-invite',
+    // Unverified users must reach support (e.g. the code never arrived).
+    '/api/support/widget',
     '/health',
   ];
 
diff --git a/packages/backend/src/ee/README.md b/packages/backend/src/ee/README.md
index 04c60417d..27d5f0dbf 100644
--- a/packages/backend/src/ee/README.md
+++ b/packages/backend/src/ee/README.md
@@ -6,6 +6,11 @@ the repository.
 
 - `cloud/` — operator-only functionality of AnythingMCP Cloud (e.g.
   onboarding lifecycle emails). Loaded only when `DEPLOYMENT_MODE=cloud`.
+- `support/` — the live support chat of the instances we operate (Cloud
+  and dedicated enterprise instances), backed by a Libredesk desk: a
+  signed widget identity with a workspace snapshot, and an AI triage of
+  new conversations. Loaded only when `SUPPORT_CHAT_*` or `LIBREDESK_*`
+  are set; self-hosted installations never load it.
 - `licensing/` — which edition a self-hosted instance runs (Community
   or a licensed plan) and what each allows. Loaded everywhere; single
   sign-on, SCIM and role sync (Enterprise) are active only with an
diff --git a/packages/backend/src/ee/support/libredesk.client.ts b/packages/backend/src/ee/support/libredesk.client.ts
new file mode 100644
index 000000000..ab36a62cd
--- /dev/null
+++ b/packages/backend/src/ee/support/libredesk.client.ts
@@ -0,0 +1,81 @@
+import { SupportTriageConfig } from './support-config';
+
+const TIMEOUT_MS = 15_000;
+
+export interface LibredeskMessage {
+  type: string;
+  private: boolean;
+  sender_type: string;
+  text_content?: string;
+  content?: string;
+  created_at?: string;
+}
+
+/** Minimal REST client for the endpoints the triage uses (API-key auth). */
+export class LibredeskClient {
+  constructor(
+    private readonly cfg: SupportTriageConfig,
+    private readonly fetchImpl: typeof fetch = fetch,
+  ) {}
+
+  private async call<T = unknown>(method: string, path: string, body?: unknown): Promise<T> {
+    const res = await this.fetchImpl(`${this.cfg.baseUrl}${path}`, {
+      method,
+      headers: {
+        Authorization: `token ${this.cfg.apiKey}:${this.cfg.apiSecret}`,
+        'Content-Type': 'application/json',
+      },
+      body: body === undefined ? undefined : JSON.stringify(body),
+      signal: AbortSignal.timeout(TIMEOUT_MS),
+    });
+    const text = await res.text();
+    if (!res.ok) {
+      throw new Error(`Libredesk ${method} ${path} -> ${res.status}: ${text.slice(0, 200)}`);
+    }
+    const parsed = text ? JSON.parse(text) : {};
+    return parsed?.data as T;
+  }
+
+  async incomingMessages(uuid: string): Promise<LibredeskMessage[]> {
+    const page = await this.call<{ results?: LibredeskMessage[] }>(
+      'GET',
+      `/api/v1/conversations/${encodeURIComponent(uuid)}/messages?page=1&page_size=30&type=incoming`,
+    );
+    return page?.results ?? [];
+  }
+
+  addTags(uuid: string, tags: string[]) {
+    return this.call('POST', `/api/v1/conversations/${encodeURIComponent(uuid)}/tags`, {
+      tags,
+      action: 'add_tags',
+    });
+  }
+
+  setPriority(uuid: string, priority: string) {
+    return this.call('PUT', `/api/v1/conversations/${encodeURIComponent(uuid)}/priority`, { priority });
+  }
+
+  assignTeam(uuid: string, teamId: number) {
+    return this.call('PUT', `/api/v1/conversations/${encodeURIComponent(uuid)}/assignee/team`, {
+      assignee_id: teamId,
+    });
+  }
+
+  assignUser(uuid: string, userId: number) {
+    return this.call('PUT', `/api/v1/conversations/${encodeURIComponent(uuid)}/assignee/user`, {
+      assignee_id: userId,
+    });
+  }
+
+  addPrivateNote(uuid: string, html: string) {
+    return this.call('POST', `/api/v1/conversations/${encodeURIComponent(uuid)}/messages`, {
+      message: html,
+      private: true,
+      sender_type: 'agent',
+    });
+  }
+
+  async teams(): Promise<Array<{ id: number; name: string }>> {
+    return (await this.call<Array<{ id: number; name: string }>>('GET', '/api/v1/teams/compact')) ?? [];
+  }
+}
diff --git a/packages/backend/src/ee/support/support-config.ts b/packages/backend/src/ee/support/support-config.ts
new file mode 100644
index 000000000..d332b826e
--- /dev/null
+++ b/packages/backend/src/ee/support/support-config.ts
@@ -0,0 +1,73 @@
+/**
+ * Environment for the support desk (a Libredesk instance operated by us).
+ *
+ * Two independent parts, each enabled by its own variables:
+ * - the chat widget (SUPPORT_CHAT_*): set on every instance we host, Cloud
+ *   and the dedicated instances of enterprise customers;
+ * - the triage webhook (LIBREDESK_*): set on one instance only (Cloud), which
+ *   receives every new conversation and tags, prioritises and annotates it.
+ *
+ * Self-hosted installations set none of these, so the module is not loaded.
+ */
+
+export interface SupportChatConfig {
+  /** Libredesk root URL, e.g. https://support.anythingmcp.com */
+  baseUrl: string;
+  /** UUID of the live chat inbox. */
+  inboxId: string;
+  /** The inbox's identity-verification secret (HS256 key for the user JWT). */
+  secret: string;
+}
+
+export interface SupportTriageConfig {
+  baseUrl: string;
+  apiKey: string;
+  apiSecret: string;
+  webhookSecret: string;
+  /**
+   * Libredesk user id of the AI assistant. When set, chats in categories it
+   * can handle are assigned to it so it answers from the knowledge base;
+   * the rest go straight to a human team.
+   */
+  aiAssistantUserId: number | null;
+}
+
+const trimUrl = (v: string | undefined) => (v || '').trim().replace(/\/+$/, '');
+
+export function supportChatConfig(env: NodeJS.ProcessEnv = process.env): SupportChatConfig | null {
+  const baseUrl = trimUrl(env.SUPPORT_CHAT_URL);
+  const inboxId = (env.SUPPORT_CHAT_INBOX_ID || '').trim();
+  const secret = (env.SUPPORT_CHAT_SECRET || '').trim();
+  if (!baseUrl || !inboxId || !secret) return null;
+  return { baseUrl, inboxId, secret };
+}
+
+export function supportTriageConfig(env: NodeJS.ProcessEnv = process.env): SupportTriageConfig | null {
+  const baseUrl = trimUrl(env.LIBREDESK_API_URL || env.SUPPORT_CHAT_URL);
+  const apiKey = (env.LIBREDESK_API_KEY || '').trim();
+  const apiSecret = (env.LIBREDESK_API_SECRET || '').trim();
+  const webhookSecret = (env.LIBREDESK_WEBHOOK_SECRET || '').trim();
+  if (!baseUrl || !apiKey || !apiSecret || !webhookSecret) return null;
+  const assistant = Number.parseInt(env.LIBREDESK_AI_ASSISTANT_USER_ID || '', 10);
+  return {
+    baseUrl,
+    apiKey,
+    apiSecret,
+    webhookSecret,
+    aiAssistantUserId: Number.isInteger(assistant) && assistant > 0 ? assistant : null,
+  };
+}
+
+export function supportModuleEnabled(env: NodeJS.ProcessEnv = process.env): boolean {
+  return supportChatConfig(env) !== null || supportTriageConfig(env) !== null;
+}
+
+/** Host name of this instance, used to tell instances apart in the desk. */
+export function instanceHost(env: NodeJS.ProcessEnv = process.env): string {
+  const raw = env.FRONTEND_URL || env.SERVER_URL || '';
+  try {
+    return new URL(raw).host || 'unknown';
+  } catch {
+    return 'unknown';
+  }
+}
diff --git a/packages/backend/src/ee/support/support-identity.service.spec.ts b/packages/backend/src/ee/support/support-identity.service.spec.ts
new file mode 100644
index 000000000..6b86291b9
--- /dev/null
+++ b/packages/backend/src/ee/support/support-identity.service.spec.ts
@@ -0,0 +1,159 @@
+import { NotFoundException } from '@nestjs/common';
+import { JwtService } from '@nestjs/jwt';
+import { SupportIdentityService, splitName } from './support-identity.service';
+import { instanceHost, supportChatConfig, supportModuleEnabled, supportTriageConfig } from './support-config';
+
+const SAVED = { ...process.env };
+
+function fakePrisma() {
+  return {
+    user: {
+      findUnique: jest.fn().mockImplementation(({ select }) =>
+        Promise.resolve(
+          select.email
+            ? { id: 'u1', email: 'ada@example.com', name: 'Ada Lovelace' }
+            : { role: 'ADMIN', createdAt: new Date('2026-10-01T10:00:00Z'), emailVerified: true },
+        ),
+      ),
+    },
+    organization: { findUnique: jest.fn().mockResolvedValue({ name: 'Acme' }) },
+    connector: {
+      findMany: jest.fn().mockResolvedValue([
+        { id: 'c1', name: 'Etsy', isActive: true, authStatus: 'needs_reauth', authStatusMessage: 'refresh token revoked' },
+        { id: 'c2', name: 'Shopify', isActive: true, authStatus: null, authStatusMessage: null },
+        { id: 'c3', name: 'Old', isActive: false, authStatus: null, authStatusMessage: null },
+      ]),
+    },
+    toolInvocation: {
+      groupBy: jest.fn().mockResolvedValue([{ connectorId: 'c2', _count: { _all: 7 } }]),
+      findFirst: jest.fn().mockResolvedValue({
+        error: '401 Unauthorized: token=FAKE-not-a-real-credential-0000',
+        tool: { name: 'shopify_list_orders' },
+      }),
+    },
+  };
+}
+
+function build(isCloud = true) {
+  const prisma = fakePrisma();
+  const deployment = { isCloud: () => isCloud };
+  const license = {
+    getCurrentLicense: jest.fn().mockResolvedValue({
+      plan: 'trial',
+      status: 'active',
+      expiresAt: new Date('2026-10-26T00:00:00Z'),
+    }),
+  };
+  return { svc: new SupportIdentityService(prisma as any, deployment as any, license as any), prisma, license };
+}
+
+describe('support config', () => {
+  afterEach(() => {
+    process.env = { ...SAVED };
+  });
+
+  it('is off unless every variable of a part is set', () => {
+    const env = { SUPPORT_CHAT_URL: 'https://desk.test/', SUPPORT_CHAT_INBOX_ID: 'i' } as any;
+    expect(supportChatConfig(env)).toBeNull();
+    expect(supportModuleEnabled(env)).toBe(false);
+    expect(supportChatConfig({ ...env, SUPPORT_CHAT_SECRET: 's' })).toEqual({
+      baseUrl: 'https://desk.test',
+      inboxId: 'i',
+      secret: 's',
+    });
+    expect(
+      supportTriageConfig({
+        SUPPORT_CHAT_URL: 'https://desk.test',
+        LIBREDESK_API_KEY: 'k',
+        LIBREDESK_API_SECRET: 's',
+        LIBREDESK_WEBHOOK_SECRET: 'w',
+      } as any)?.baseUrl,
+    ).toBe('https://desk.test');
+    const triage = {
+      SUPPORT_CHAT_URL: 'https://desk.test',
+      LIBREDESK_API_KEY: 'k',
+      LIBREDESK_API_SECRET: 's',
+      LIBREDESK_WEBHOOK_SECRET: 'w',
+    } as any;
+    expect(supportTriageConfig(triage)?.aiAssistantUserId).toBeNull();
+    expect(supportTriageConfig({ ...triage, LIBREDESK_AI_ASSISTANT_USER_ID: '5' })?.aiAssistantUserId).toBe(5);
+    expect(supportTriageConfig({ ...triage, LIBREDESK_AI_ASSISTANT_USER_ID: 'x' })?.aiAssistantUserId).toBeNull();
+  });
+
+  it('instance host comes from FRONTEND_URL', () => {
+    expect(instanceHost({ FRONTEND_URL: 'https://cloud.anythingmcp.com' } as any)).toBe('cloud.anythingmcp.com');
+    expect(instanceHost({} as any)).toBe('unknown');
+  });
+});
+
+describe('SupportIdentityService', () => {
+  beforeEach(() => {
+    process.env.SUPPORT_CHAT_URL = 'https://desk.test';
+    process.env.SUPPORT_CHAT_INBOX_ID = 'inbox-uuid';
+    process.env.SUPPORT_CHAT_SECRET = 'inbox-secret';
+    process.env.FRONTEND_URL = 'https://cloud.anythingmcp.com';
+  });
+  afterEach(() => {
+    process.env = { ...SAVED };
+  });
+
+  it('signs an HS256 identity the desk can verify, scoped per instance', async () => {
+    const { svc } = build();
+    const session = await svc.widgetSession('u1', 'org1');
+    expect(session).toMatchObject({ baseUrl: 'https://desk.test', inboxId: 'inbox-uuid' });
+
+    const claims: any = new JwtService().verify(session.userJwt, { secret: 'inbox-secret', algorithms: ['HS256'] });
+    expect(claims.external_user_id).toBe('cloud.anythingmcp.com:u1');
+    expect(claims.email).toBe('ada@example.com');
+    expect(claims.first_name).toBe('Ada');
+    expect(claims.last_name).toBe('Lovelace');
+    expect(claims.exp - claims.iat).toBe(3600);
+    expect(claims.contact_custom_attributes).toMatchObject({
+      deployment: 'cloud',
+      organization_name: 'Acme',
+      plan: 'trial',
+      trial_ends_at: '2026-10-26',
+      connectors: '3 (1 inactive)',
+    });
+  });
+
+  it('summarises connector issues without leaking credentials', async () => {
+    const { svc } = build();
+    const attrs = await svc.contactAttributes('u1', 'org1');
+    expect(attrs.connector_issues).toContain('Etsy: auth needs_reauth');
+    expect(attrs.connector_issues).toContain('Shopify: 7 failed calls/24h, last shopify_list_orders: 401');
+    expect(attrs.connector_issues).not.toContain('FAKE-not-a-real-credential-0000');
+  });
+
+  it('filters every query by the caller organization', async () => {
+    const { svc, prisma, license } = build();
+    await svc.contactAttributes('u1', 'org1');
+    expect(prisma.connector.findMany.mock.calls[0][0].where).toEqual({ organizationId: 'org1' });
+    expect(prisma.toolInvocation.groupBy.mock.calls[0][0].where.organizationId).toBe('org1');
+    expect(prisma.toolInvocation.findFirst.mock.calls[0][0].where.organizationId).toBe('org1');
+    expect(license.getCurrentLicense).toHaveBeenCalledWith('org1');
+  });
+
+  it('caches the snapshot for a few minutes', async () => {
+    const { svc, prisma } = build();
+    await svc.contactAttributes('u1', 'org1');
+    await svc.contactAttributes('u1', 'org1');
+    expect(prisma.connector.findMany).toHaveBeenCalledTimes(1);
+  });
+
+  it('marks dedicated instances', async () => {
+    const { svc } = build(false);
+    expect((await svc.contactAttributes('u1', 'org1')).deployment).toBe('dedicated');
+  });
+
+  it('is 404 when the chat is not configured', async () => {
+    delete process.env.SUPPORT_CHAT_SECRET;
+    const { svc } = build();
+    await expect(svc.widgetSession('u1', 'org1')).rejects.toBeInstanceOf(NotFoundException);
+  });
+
+  it('splitName falls back to the email local part', () => {
+    expect(splitName(null, 'bob@x.test')).toEqual({ first: 'bob', last: '' });
+    expect(splitName('  Grace   Brewster Hopper ', 'g@x.test')).toEqual({ first: 'Grace', last: 'Brewster Hopper' });
+  });
+});
diff --git a/packages/backend/src/ee/support/support-identity.service.ts b/packages/backend/src/ee/support/support-identity.service.ts
new file mode 100644
index 000000000..c6729bca0
--- /dev/null
+++ b/packages/backend/src/ee/support/support-identity.service.ts
@@ -0,0 +1,172 @@
+import { Injectable, NotFoundException } from '@nestjs/common';
+import { JwtService } from '@nestjs/jwt';
+import { PrismaService } from '../../common/prisma.service';
+import { DeploymentService } from '../../common/deployment.service';
+import { LicenseService } from '../../license/license.service';
+import { instanceHost, supportChatConfig } from './support-config';
+import { compactError } from './support-redact';
+
+/** Contact attributes shown to agents and read by the triage. All strings. */
+export type SupportContactAttributes = Record<string, string>;
+
+export interface SupportWidgetSession {
+  baseUrl: string;
+  inboxId: string;
+  userJwt: string;
+}
+
+const CONTEXT_TTL_MS = 5 * 60_000;
+const CONTEXT_CACHE_MAX = 5_000;
+const JWT_TTL_SECONDS = 60 * 60;
+const ERROR_WINDOW_MS = 24 * 60 * 60_000;
+const MAX_ISSUES = 5;
+const ISSUES_MAX_CHARS = 900;
+
+/**
+ * Builds the signed identity the Libredesk widget exchanges for a verified
+ * contact, carrying a snapshot of the workspace (plan, trial end, connectors
+ * that are failing) so agents and the triage see it without asking.
+ *
+ * Organization-scoped: every query filters by the caller's organizationId.
+ */
+@Injectable()
+export class SupportIdentityService {
+  private readonly jwt = new JwtService();
+  private readonly cache = new Map<string, { at: number; attrs: SupportContactAttributes }>();
+
+  constructor(
+    private readonly prisma: PrismaService,
+    private readonly deployment: DeploymentService,
+    private readonly license: LicenseService,
+  ) {}
+
+  async widgetSession(userId: string, organizationId: string | null): Promise<SupportWidgetSession> {
+    const cfg = supportChatConfig();
+    if (!cfg) throw new NotFoundException();
+
+    const user = await this.prisma.user.findUnique({
+      where: { id: userId },
+      select: { id: true, email: true, name: true },
+    });
+    if (!user) throw new NotFoundException();
+
+    const attrs = await this.contactAttributes(userId, organizationId);
+    const { first, last } = splitName(user.name, user.email);
+    const userJwt = this.jwt.sign(
+      {
+        // Unique per instance: the same person may exist on Cloud and on a
+        // dedicated instance, and those are different accounts.
+        external_user_id: `${instanceHost()}:${user.id}`.slice(0, 128),
+        email: user.email.slice(0, 254),
+        first_name: first,
+        ...(last ? { last_name: last } : {}),
+        contact_custom_attributes: attrs,
+      },
+      { secret: cfg.secret, algorithm: 'HS256', expiresIn: JWT_TTL_SECONDS },
+    );
+    return { baseUrl: cfg.baseUrl, inboxId: cfg.inboxId, userJwt };
+  }
+
+  /** Cached for a few minutes: the widget asks on every full page load. */
+  async contactAttributes(userId: string, organizationId: string | null): Promise<SupportContactAttributes> {
+    const key = `${organizationId ?? ''}:${userId}`;
+    const hit = this.cache.get(key);
+    if (hit && Date.now() - hit.at < CONTEXT_TTL_MS) return hit.attrs;
+
+    const attrs = await this.buildAttributes(userId, organizationId);
+    if (this.cache.size >= CONTEXT_CACHE_MAX) {
+      const oldest = this.cache.keys().next().value;
+      if (oldest !== undefined) this.cache.delete(oldest);
+    }
+    this.cache.set(key, { at: Date.now(), attrs });
+    return attrs;
+  }
+
+  private async buildAttributes(userId: string, organizationId: string | null): Promise<SupportContactAttributes> {
+    const user = await this.prisma.user.findUnique({
+      where: { id: userId },
+      select: { role: true, createdAt: true, emailVerified: true },
+    });
+    const attrs: SupportContactAttributes = {
+      instance: instanceHost(),
+      deployment: this.deployment.isCloud() ? 'cloud' : 'dedicated',
+      role: user?.role ?? '',
+      signed_up_at: user?.createdAt ? user.createdAt.toISOString().slice(0, 10) : '',
+    };
+    if (user && !user.emailVerified) attrs.email_verified = 'no';
+    if (!organizationId) return attrs;
+
+    const [org, license, connectors] = await Promise.all([
+      this.prisma.organization.findUnique({ where: { id: organizationId }, select: { name: true } }),
+      this.license.getCurrentLicense(organizationId).catch(() => null),
+      this.prisma.connector.findMany({
+        where: { organizationId },
+        select: { id: true, name: true, isActive: true, authStatus: true, authStatusMessage: true },
+        orderBy: { createdAt: 'asc' },
+      }),
+    ]);
+
+    attrs.organization_id = organizationId;
+    attrs.organization_name = org?.name ?? '';
+    attrs.plan = license?.plan ?? 'none';
+    attrs.license_status = license?.status ?? '';
+    if (license?.plan === 'trial' && license.expiresAt) {
+      attrs.trial_ends_at = new Date(license.expiresAt).toISOString().slice(0, 10);
+    }
+
+    const inactive = connectors.filter((c) => !c.isActive).length;
+    attrs.connectors = inactive ? `${connectors.length} (${inactive} inactive)` : String(connectors.length);
+    attrs.connector_issues = await this.connectorIssues(organizationId, connectors);
+    return attrs;
+  }
+
+  /**
+   * One line per connector that needs attention: an auth problem, or calls
+   * that failed in the last 24 hours with the latest error (redacted).
+   */
+  private async connectorIssues(
+    organizationId: string,
+    connectors: Array<{ id: string; name: string; authStatus: string | null; authStatusMessage: string | null }>,
+  ): Promise<string> {
+    if (connectors.length === 0) return '';
+    const since = new Date(Date.now() - ERROR_WINDOW_MS);
+    const failing = await this.prisma.toolInvocation.groupBy({
+      by: ['connectorId'],
+      where: { organizationId, status: { in: ['ERROR', 'TIMEOUT'] }, createdAt: { gte: since } },
+      _count: { _all: true },
+    });
+    const errorCount = new Map<string, number>();
+    for (const row of failing) if (row.connectorId) errorCount.set(row.connectorId, row._count._all);
+
+    const lines: string[] = [];
+    for (const c of connectors) {
+      if (lines.length >= MAX_ISSUES) break;
+      const parts: string[] = [];
+      if (c.authStatus) {
+        parts.push(`auth ${c.authStatus}${c.authStatusMessage ? ` (${compactError(c.authStatusMessage, 80)})` : ''}`);
+      }
+      const errors = errorCount.get(c.id);
+      if (errors) {
+        const last = await this.prisma.toolInvocation.findFirst({
+          where: { organizationId, connectorId: c.id, status: { in: ['ERROR', 'TIMEOUT'] }, createdAt: { gte: since } },
+          orderBy: { createdAt: 'desc' },
+          select: { error: true, tool: { select: { name: true } } },
+        });
+        const tool = last?.tool?.name ? `${last.tool.name}: ` : '';
+        parts.push(`${errors} failed calls/24h${last?.error ? `, last ${tool}${compactError(last.error)}` : ''}`);
+      }
+      if (parts.length) lines.push(`${c.name}: ${parts.join('; ')}`);
+    }
+    const text = lines.join(' | ');
+    return text.length > ISSUES_MAX_CHARS ? `${text.slice(0, ISSUES_MAX_CHARS - 1)}…` : text;
+  }
+}
+
+export function splitName(name: string | null | undefined, email: string): { first: string; last: string } {
+  const clean = (name || '').trim().replace(/\s+/g, ' ');
+  if (clean) {
+    const [first, ...rest] = clean.split(' ');
+    return { first: first.slice(0, 128), last: rest.join(' ').slice(0, 128) };
+  }
+  return { first: (email.split('@')[0] || 'User').slice(0, 128), last: '' };
+}
diff --git a/packages/backend/src/ee/support/support-redact.ts b/packages/backend/src/ee/support/support-redact.ts
new file mode 100644
index 000000000..1520814b8
--- /dev/null
+++ b/packages/backend/src/ee/support/support-redact.ts
@@ -0,0 +1,29 @@
+/**
+ * Scrubs credentials out of text that leaves the instance for the support
+ * desk or its AI triage: upstream error messages sometimes echo the request
+ * (a bearer token, an api_key query parameter, a signed URL).
+ */
+const SECRET_PATTERNS: Array<[RegExp, string]> = [
+  [/\b(Bearer|Basic|token)\s+[A-Za-z0-9._~+/=:-]{8,}/gi, '$1 [redacted]'],
+  [
+    /\b(api[_-]?key|apikey|access[_-]?token|refresh[_-]?token|client[_-]?secret|secret|password|passwd|pwd|token|signature|sig|key)(["']?\s*[:=]\s*["']?)[^\s"'&,;}]+/gi,
+    '$1$2[redacted]',
+  ],
+  // JWTs
+  [/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g, '[jwt]'],
+  // Long opaque strings (keys, hashes) that survived the rules above
+  [/\b[A-Za-z0-9_-]{32,}\b/g, '[redacted]'],
+];
+
+export function redactSecrets(text: string | null | undefined): string {
+  if (!text) return '';
+  let out = text;
+  for (const [re, repl] of SECRET_PATTERNS) out = out.replace(re, repl);
+  return out;
+}
+
+/** One line, at most `max` characters, credentials removed. */
+export function compactError(text: string | null | undefined, max = 160): string {
+  const flat = redactSecrets(text).replace(/\s+/g, ' ').trim();
+  return flat.length > max ? `${flat.slice(0, max - 1)}…` : flat;
+}
diff --git a/packages/backend/src/ee/support/support-triage.service.spec.ts b/packages/backend/src/ee/support/support-triage.service.spec.ts
new file mode 100644
index 000000000..e90ef50b7
--- /dev/null
+++ b/packages/backend/src/ee/support/support-triage.service.spec.ts
@@ -0,0 +1,197 @@
+import {
+  SupportTriageService,
+  fallbackTriage,
+  normaliseAttrs,
+  parseTriage,
+  segmentTags,
+  triageNote,
+} from './support-triage.service';
+import { compactError, redactSecrets } from './support-redact';
+import * as llm from '../../knowledge-graph/llm-client';
+
+function fakeDesk(messages: any[] = []) {
+  return {
+    incomingMessages: jest.fn().mockResolvedValue(messages),
+    addTags: jest.fn().mockResolvedValue(true),
+    setPriority: jest.fn().mockResolvedValue(true),
+    assignTeam: jest.fn().mockResolvedValue(true),
+    assignUser: jest.fn().mockResolvedValue(true),
+    addPrivateNote: jest.fn().mockResolvedValue(true),
+    teams: jest.fn().mockResolvedValue([
+      { id: 1, name: 'Support' },
+      { id: 2, name: 'Enterprise' },
+    ]),
+  };
+}
+
+class TestTriage extends SupportTriageService {
+  constructor(
+    private readonly desk: any,
+    private readonly llmCfg: any = { provider: 'anthropic', model: 'm', apiKey: 'k' },
+    private readonly assistantId: number | null = null,
+  ) {
+    super();
+  }
+  protected client() {
+    return this.desk;
+  }
+  protected aiAssistantUserId() {
+    return this.assistantId;
+  }
+  protected llm() {
+    return this.llmCfg;
+  }
+}
+
+describe('support triage helpers', () => {
+  it('segment tags follow deployment and plan', () => {
+    expect(segmentTags({ deployment: 'cloud', plan: 'trial' })).toEqual(['cloud', 'trial']);
+    expect(segmentTags({ deployment: 'cloud', plan: 'starter' })).toEqual(['cloud', 'paid']);
+    expect(segmentTags({ deployment: 'cloud', plan: 'none' })).toEqual(['cloud']);
+    expect(segmentTags({ deployment: 'dedicated', plan: 'enterprise' })).toEqual([
+      'self-hosted',
+      'enterprise',
+      'paid',
+    ]);
+  });
+
+  it('parseTriage clamps unknown values and raises billing and enterprise to High', () => {
+    expect(parseTriage({ category: 'nonsense', priority: 'Urgent' }, {})).toMatchObject({
+      category: 'other',
+      priority: 'Medium',
+    });
+    expect(parseTriage({ category: 'billing', priority: 'Low' }, {})?.priority).toBe('High');
+    expect(parseTriage({ category: 'bug', priority: 'Low' }, { deployment: 'dedicated' })?.priority).toBe('High');
+    expect(parseTriage(null, {})).toBeNull();
+  });
+
+  it('reads only the known contact attributes', () => {
+    const raw = JSON.parse('{"plan":"trial","__proto__":{"x":1},"constructor":"y","other":"z","connectors":3}');
+    const out = normaliseAttrs(raw);
+    expect(out).toEqual({ plan: 'trial', connectors: '3' });
+    expect(({} as any).x).toBeUndefined();
+  });
+
+  it('fallback keeps enterprise conversations at High', () => {
+    expect(fallbackTriage({ deployment: 'dedicated' }).priority).toBe('High');
+    expect(fallbackTriage({ deployment: 'cloud' }).priority).toBe('Medium');
+  });
+
+  it('the note escapes model output', () => {
+    const html = triageNote(
+      { category: 'bug', priority: 'High', language: 'it', summary: '<script>x</script>', suggestedReply: 'a\nb' },
+      { plan: 'trial', connector_issues: 'Etsy: auth needs_reauth' },
+    );
+    expect(html).not.toContain('<script>');
+    expect(html).toContain('&lt;script&gt;');
+    expect(html).toContain('a<br>b');
+    expect(html).toContain('Etsy: auth needs_reauth');
+  });
+
+  it('redacts credentials from error text', () => {
+    const out = redactSecrets(
+      'GET https://x.test/v1?api_key=abc123secret failed: Authorization: Bearer sk-live-1234567890abcdef',
+    );
+    expect(out).not.toContain('abc123secret');
+    expect(out).not.toContain('sk-live-1234567890abcdef');
+    expect(compactError('x'.repeat(10) + ' ' + 'y '.repeat(200), 40).length).toBeLessThanOrEqual(40);
+  });
+});
+
+describe('SupportTriageService', () => {
+  afterEach(() => jest.restoreAllMocks());
+
+  it('classifies, tags, prioritises, assigns and writes a private note', async () => {
+    const desk = fakeDesk([
+      { private: false, sender_type: 'contact', text_content: 'My Etsy connector says unauthorized' },
+      { private: true, sender_type: 'agent', text_content: 'internal' },
+    ]);
+    const chat = jest.spyOn(llm, 'chatJson').mockResolvedValue({
+      json: { category: 'connector-error', priority: 'Medium', language: 'en', summary: 's', suggested_reply: 'r' },
+    });
+    const svc = new TestTriage(desk);
+    const res = await svc.triage({
+      uuid: 'c1',
+      contact: { custom_attributes: { deployment: 'cloud', plan: 'trial', organization_id: 'org-secret' } },
+    });
+
+    expect(res?.category).toBe('connector-error');
+    const userPrompt = chat.mock.calls[0][2];
+    expect(userPrompt).toContain('My Etsy connector says unauthorized');
+    expect(userPrompt).not.toContain('internal');
+    expect(userPrompt).not.toContain('org-secret');
+    expect(desk.addTags).toHaveBeenCalledWith('c1', ['connector-error', 'cloud', 'trial', 'ai-triaged']);
+    expect(desk.setPriority).toHaveBeenCalledWith('c1', 'Medium');
+    expect(desk.assignTeam).toHaveBeenCalledWith('c1', 1);
+    expect(desk.addPrivateNote).toHaveBeenCalledTimes(1);
+  });
+
+  it('routes dedicated instances to the Enterprise team', async () => {
+    const desk = fakeDesk([{ private: false, sender_type: 'contact', text_content: 'help' }]);
+    jest.spyOn(llm, 'chatJson').mockResolvedValue({ json: { category: 'bug', priority: 'Low' } });
+    await new TestTriage(desk).triage({ uuid: 'c2', contact: { custom_attributes: { deployment: 'dedicated' } } });
+    expect(desk.assignTeam).toHaveBeenCalledWith('c2', 2);
+    expect(desk.setPriority).toHaveBeenCalledWith('c2', 'High');
+  });
+
+  it('still tags and annotates when the LLM is unavailable', async () => {
+    const desk = fakeDesk([{ private: false, sender_type: 'contact', text_content: 'help' }]);
+    const chat = jest.spyOn(llm, 'chatJson');
+    await new TestTriage(desk, null).triage({ uuid: 'c3', contact: { custom_attributes: { deployment: 'cloud' } } });
+    expect(chat).not.toHaveBeenCalled();
+    expect(desk.addTags).toHaveBeenCalledWith('c3', ['other', 'cloud', 'ai-triaged']);
+  });
+
+  it('handles each conversation once and skips already-triaged ones', async () => {
+    const desk = fakeDesk([]);
+    const svc = new TestTriage(desk, null);
+    await svc.triage({ uuid: 'c4' });
+    await svc.triage({ uuid: 'c4' });
+    await svc.triage({ uuid: 'c5', tags: ['ai-triaged'] });
+    expect(desk.addTags).toHaveBeenCalledTimes(1);
+  });
+
+  it('hands safe live chats to the AI assistant after the team, never billing or enterprise', async () => {
+    const msgs = [{ private: false, sender_type: 'contact', text_content: 'help' }];
+    const chat = jest.spyOn(llm, 'chatJson');
+
+    chat.mockResolvedValueOnce({ json: { category: 'connector-setup', priority: 'Medium' } });
+    const desk = fakeDesk(msgs);
+    await new TestTriage(desk, undefined, 5).triage({
+      uuid: 'a1',
+      inbox_channel: 'livechat',
+      contact: { custom_attributes: { deployment: 'cloud', plan: 'trial' } },
+    });
+    expect(desk.addTags).toHaveBeenCalledWith('a1', ['connector-setup', 'cloud', 'trial', 'ai-triaged', 'ai-assistant']);
+    expect(desk.assignUser).toHaveBeenCalledWith('a1', 5);
+    expect(desk.assignTeam.mock.invocationCallOrder[0]).toBeLessThan(desk.assignUser.mock.invocationCallOrder[0]);
+
+    chat.mockResolvedValueOnce({ json: { category: 'billing', priority: 'Low' } });
+    const billing = fakeDesk(msgs);
+    await new TestTriage(billing, undefined, 5).triage({ uuid: 'a2', inbox_channel: 'livechat', contact: { custom_attributes: { deployment: 'cloud' } } });
+    expect(billing.assignUser).not.toHaveBeenCalled();
+
+    chat.mockResolvedValueOnce({ json: { category: 'connector-setup', priority: 'Low' } });
+    const ent = fakeDesk(msgs);
+    await new TestTriage(ent, undefined, 5).triage({ uuid: 'a3', inbox_channel: 'livechat', contact: { custom_attributes: { deployment: 'dedicated' } } });
+    expect(ent.assignUser).not.toHaveBeenCalled();
+
+    chat.mockResolvedValueOnce({ json: { category: 'connector-setup', priority: 'Low' } });
+    const email = fakeDesk(msgs);
+    await new TestTriage(email, undefined, 5).triage({ uuid: 'a4', inbox_channel: 'email', contact: { custom_attributes: { deployment: 'cloud' } } });
+    expect(email.assignUser).not.toHaveBeenCalled();
+
+    chat.mockResolvedValueOnce({ json: { category: 'connector-setup', priority: 'Low' } });
+    const off = fakeDesk(msgs);
+    await new TestTriage(off).triage({ uuid: 'a5', inbox_channel: 'livechat', contact: { custom_attributes: { deployment: 'cloud' } } });
+    expect(off.assignUser).not.toHaveBeenCalled();
+  });
+
+  it('a failing step does not stop the others', async () => {
+    const desk = fakeDesk([]);
+    desk.addTags.mockRejectedValue(new Error('tag missing'));
+    await new TestTriage(desk, null).triage({ uuid: 'c6' });
+    expect(desk.setPriority).toHaveBeenCalled();
+    expect(desk.addPrivateNote).toHaveBeenCalled();
+  });
+});
diff --git a/packages/backend/src/ee/support/support-triage.service.ts b/packages/backend/src/ee/support/support-triage.service.ts
new file mode 100644
index 000000000..480d7b080
--- /dev/null
+++ b/packages/backend/src/ee/support/support-triage.service.ts
@@ -0,0 +1,323 @@
+import { Injectable, Logger } from '@nestjs/common';
+import { chatJson, resolveLlmConfig, LlmConfig } from '../../knowledge-graph/llm-client';
+import { redactPii } from '../../knowledge-graph/redact';
+import { LibredeskClient } from './libredesk.client';
+import { supportTriageConfig } from './support-config';
+import { redactSecrets } from './support-redact';
+
+export const TRIAGE_CATEGORIES = [
+  'connector-setup',
+  'connector-error',
+  'new-connector-request',
+  'billing',
+  'account',
+  'bug',
+  'feature-request',
+  'enterprise-sales',
+  'other',
+] as const;
+export type TriageCategory = (typeof TRIAGE_CATEGORIES)[number];
+
+/**
+ * Categories the AI assistant may answer on its own. Billing, bugs, feature
+ * requests and sales always go to a person.
+ */
+export const AI_HANDLED_CATEGORIES: readonly TriageCategory[] = [
+  'connector-setup',
+  'connector-error',
+  'new-connector-request',
+  'account',
+  'other',
+];
+
+const PRIORITIES = ['Low', 'Medium', 'High'] as const;
+type Priority = (typeof PRIORITIES)[number];
+
+export interface TriageResult {
+  category: TriageCategory;
+  priority: Priority;
+  language: string;
+  summary: string;
+  suggestedReply: string;
+}
+
+/** The subset of a Libredesk conversation the triage reads. */
+export interface DeskConversation {
+  uuid: string;
+  subject?: string | null;
+  last_message?: string | null;
+  inbox_channel?: string;
+  tags?: string[] | null;
+  contact?: {
+    first_name?: string;
+    email?: string | null;
+    external_user_id?: string | null;
+    custom_attributes?: Record<string, unknown> | null;
+  };
+}
+
+const MAX_CUSTOMER_TEXT = 4_000;
+const SEEN_MAX = 2_000;
+
+const SYSTEM_PROMPT = `You triage support conversations for AnythingMCP, a product that turns any API, database or business app into an MCP server so that Claude, ChatGPT, Cursor and other AI assistants can use it. Customers install "connectors" (from a catalog of several hundred apps, or their own REST/GraphQL/SOAP/database), then connect their AI assistant to their MCP server URL. It is sold as AnythingMCP Cloud (cloud.anythingmcp.com, 7-day trial, then a paid plan) and as dedicated instances for enterprise customers.
+
+Typical problems: OAuth apps whose redirect URI is not set to <instance URL>/api/mcp-oauth/callback; API keys pasted in the wrong field or with spaces; expired or revoked tokens ("needs_reauth"); the AI client not connected to the MCP URL; trial ended; plan or invoice questions; requests for a connector we do not have yet.
+
+You receive the customer's messages and a snapshot of their workspace (plan, trial end, connectors, connector issues of the last 24 hours). Return ONLY a JSON object:
+{
+  "category": one of ${TRIAGE_CATEGORIES.map((c) => `"${c}"`).join(', ')},
+  "priority": "Low" | "Medium" | "High",
+  "language": ISO 639-1 code of the customer's language,
+  "summary": one or two sentences in English for the support agent, naming the likely cause when the workspace snapshot shows it,
+  "suggested_reply": a reply draft for a human agent to review, in the customer's language
+}
+
+Priority: High when the customer cannot use the product at all, for billing problems, and for enterprise customers; Low for feature and connector requests; otherwise Medium.
+
+Rules for suggested_reply: short, friendly, concrete next steps; use the workspace snapshot when it explains the problem; never promise refunds, cancellations, discounts, deadlines or features; never offer a call or meeting; for billing write that a person will check and reply; do not invent settings or URLs you are not sure of; no em dashes.`;
+
+/**
+ * Tags, prioritises and annotates every new support conversation. Runs only
+ * on the instance that holds the Libredesk API key (Cloud). The suggested
+ * reply goes into a private note: nothing is sent to the customer.
+ */
+@Injectable()
+export class SupportTriageService {
+  private readonly logger = new Logger(SupportTriageService.name);
+  private readonly seen = new Set<string>();
+  private teamIds: Map<string, number> | null = null;
+
+  /** Test seam. */
+  protected client(): LibredeskClient | null {
+    const cfg = supportTriageConfig();
+    return cfg ? new LibredeskClient(cfg) : null;
+  }
+
+  protected aiAssistantUserId(): number | null {
+    return supportTriageConfig()?.aiAssistantUserId ?? null;
+  }
+
+  protected llm(): LlmConfig | null {
+    return resolveLlmConfig();
+  }
+
+  async triage(conv: DeskConversation): Promise<TriageResult | null> {
+    if (!conv?.uuid || this.seen.has(conv.uuid)) return null;
+    if ((conv.tags ?? []).includes('ai-triaged')) return null;
+    this.remember(conv.uuid);
+
+    const desk = this.client();
+    if (!desk) return null;
+
+    const attrs = normaliseAttrs(conv.contact?.custom_attributes);
+    let customerText = '';
+    try {
+      const messages = await desk.incomingMessages(conv.uuid);
+      customerText = messages
+        .filter((m) => !m.private && m.sender_type === 'contact')
+        .map((m) => (m.text_content || '').trim())
+        .filter(Boolean)
+        .join('\n---\n');
+    } catch (err) {
+      this.logger.warn(`Could not read messages of ${conv.uuid}: ${(err as Error).message}`);
+    }
+    if (!customerText) customerText = (conv.last_message || conv.subject || '').trim();
+
+    const result = (await this.classify(customerText, attrs, conv.inbox_channel)) ?? fallbackTriage(attrs);
+    await this.apply(desk, conv.uuid, result, attrs, conv.inbox_channel);
+    return result;
+  }
+
+  private async classify(
+    customerText: string,
+    attrs: Record<string, string>,
+    channel?: string,
+  ): Promise<TriageResult | null> {
+    const cfg = this.llm();
+    if (!cfg || !customerText) return null;
+    const snapshot = { ...attrs };
+    delete snapshot.organization_id;
+    const user = [
+      `Channel: ${channel || 'unknown'}`,
+      `Workspace snapshot: ${JSON.stringify(snapshot)}`,
+      'Customer messages:',
+      redactPii(redactSecrets(customerText)).slice(0, MAX_CUSTOMER_TEXT),
+    ].join('\n');
+    try {
+      const { json, skipped } = await chatJson(cfg, SYSTEM_PROMPT, user, 1200);
+      if (skipped || !json) return null;
+      return parseTriage(json, attrs);
+    } catch (err) {
+      this.logger.warn(`Support triage LLM call failed: ${(err as Error).message}`);
+      return null;
+    }
+  }
+
+  private async apply(
+    desk: LibredeskClient,
+    uuid: string,
+    r: TriageResult,
+    attrs: Record<string, string>,
+    channel?: string,
+  ) {
+    const enterprise = isEnterprise(attrs);
+    const assistant = this.aiAssistantUserId();
+    const toAssistant = routeToAssistant(r, attrs, channel, assistant);
+    const tags = [r.category, ...segmentTags(attrs), 'ai-triaged'];
+    if (toAssistant) tags.push('ai-assistant');
+    const steps: Array<[string, () => Promise<unknown>]> = [
+      ['tags', () => desk.addTags(uuid, tags)],
+      ['priority', () => desk.setPriority(uuid, r.priority)],
+      // Team first: Libredesk clears the user assignee when the team changes.
+      ['team', async () => {
+        const id = await this.teamId(desk, enterprise ? 'Enterprise' : 'Support');
+        if (id) await desk.assignTeam(uuid, id);
+      }],
+      ['note', () => desk.addPrivateNote(uuid, triageNote(r, attrs))],
+    ];
+    if (toAssistant && assistant) {
+      // Assigning the assistant starts its reply; it hands back to the
+      // Support team when it cannot help.
+      steps.push(['assistant', () => desk.assignUser(uuid, assistant)]);
+    }
+    for (const [name, run] of steps) {
+      try {
+        await run();
+      } catch (err) {
+        this.logger.warn(`Support triage step "${name}" failed for ${uuid}: ${(err as Error).message}`);
+      }
+    }
+  }
+
+  private async teamId(desk: LibredeskClient, name: string): Promise<number | undefined> {
+    if (!this.teamIds) {
+      const teams = await desk.teams();
+      this.teamIds = new Map(teams.map((t) => [t.name, t.id]));
+    }
+    return this.teamIds.get(name);
+  }
+
+  private remember(uuid: string) {
+    if (this.seen.size >= SEEN_MAX) {
+      const oldest = this.seen.values().next().value;
+      if (oldest !== undefined) this.seen.delete(oldest);
+    }
+    this.seen.add(uuid);
+  }
+}
+
+/** The contact attributes SupportIdentityService sets; anything else is ignored. */
+const KNOWN_ATTRS = [
+  'organization_id',
+  'organization_name',
+  'instance',
+  'deployment',
+  'plan',
+  'license_status',
+  'trial_ends_at',
+  'role',
+  'connectors',
+  'connector_issues',
+  'signed_up_at',
+  'email_verified',
+] as const;
+
+export function normaliseAttrs(raw: unknown): Record<string, string> {
+  const out: Record<string, string> = {};
+  if (!raw || typeof raw !== 'object') return out;
+  const src = raw as Record<string, unknown>;
+  for (const key of KNOWN_ATTRS) {
+    if (!Object.prototype.hasOwnProperty.call(src, key)) continue;
+    const v = src[key];
+    if (v === null || v === undefined) continue;
+    out[key] = (typeof v === 'string' ? v : JSON.stringify(v)).slice(0, 1000);
+  }
+  return out;
+}
+
+/** Live chat, a category the assistant handles, and never enterprise. */
+export function routeToAssistant(
+  r: TriageResult,
+  attrs: Record<string, string>,
+  channel: string | undefined,
+  assistantUserId: number | null,
+): boolean {
+  return (
+    !!assistantUserId &&
+    channel === 'livechat' &&
+    !isEnterprise(attrs) &&
+    AI_HANDLED_CATEGORIES.includes(r.category)
+  );
+}
+
+export function isEnterprise(attrs: Record<string, string>): boolean {
+  return attrs.deployment === 'dedicated' || /enterprise/i.test(attrs.plan || '');
+}
+
+export function segmentTags(attrs: Record<string, string>): string[] {
+  const tags: string[] = [];
+  if (attrs.deployment === 'cloud') tags.push('cloud');
+  if (attrs.deployment === 'dedicated') tags.push('self-hosted');
+  if (isEnterprise(attrs)) tags.push('enterprise');
+  const plan = (attrs.plan || '').toLowerCase();
+  if (plan === 'trial') tags.push('trial');
+  else if (plan && plan !== 'none' && plan !== 'community') tags.push('paid');
+  return tags;
+}
+
+export function parseTriage(json: any, attrs: Record<string, string>): TriageResult | null {
+  if (!json || typeof json !== 'object') return null;
+  const category = (TRIAGE_CATEGORIES as readonly string[]).includes(json.category)
+    ? (json.category as TriageCategory)
+    : 'other';
+  let priority: Priority = (PRIORITIES as readonly string[]).includes(json.priority)
+    ? (json.priority as Priority)
+    : 'Medium';
+  if (category === 'billing' || isEnterprise(attrs)) priority = 'High';
+  const str = (v: unknown, max: number) => (typeof v === 'string' ? v.trim().slice(0, max) : '');
+  return {
+    category,
+    priority,
+    language: str(json.language, 8) || 'en',
+    summary: str(json.summary, 600),
+    suggestedReply: str(json.suggested_reply, 3000),
+  };
+}
+
+/** Used when no LLM is configured or the call failed: segment + priority only. */
+export function fallbackTriage(attrs: Record<string, string>): TriageResult {
+  return {
+    category: 'other',
+    priority: isEnterprise(attrs) ? 'High' : 'Medium',
+    language: '',
+    summary: '',
+    suggestedReply: '',
+  };
+}
+
+const esc = (s: string) =>
+  s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+
+export function triageNote(r: TriageResult, attrs: Record<string, string>): string {
+  const ctx = [
+    ['Instance', attrs.instance],
+    ['Organization', attrs.organization_name],
+    ['Plan', [attrs.plan, attrs.license_status].filter(Boolean).join(', ')],
+    ['Trial ends', attrs.trial_ends_at],
+    ['Connectors', attrs.connectors],
+    ['Connector issues', attrs.connector_issues],
+    ['Email verified', attrs.email_verified],
+  ].filter(([, v]) => v);
+  const parts = [
+    `<p><strong>AI triage</strong>: ${esc(r.category)}, priority ${esc(r.priority)}${r.language ? `, language ${esc(r.language)}` : ''}</p>`,
+  ];
+  if (r.summary) parts.push(`<p>${esc(r.summary)}</p>`);
+  if (ctx.length) {
+    parts.push(`<ul>${ctx.map(([k, v]) => `<li><strong>${esc(k)}</strong>: ${esc(String(v))}</li>`).join('')}</ul>`);
+  }
+  if (r.suggestedReply) {
+    parts.push('<p><strong>Suggested reply</strong> (review before sending):</p>');
+    parts.push(`<blockquote>${esc(r.suggestedReply).replace(/\n/g, '<br>')}</blockquote>`);
+  }
+  return parts.join('');
+}
diff --git a/packages/backend/src/ee/support/support.controller.spec.ts b/packages/backend/src/ee/support/support.controller.spec.ts
new file mode 100644
index 000000000..d8e898ddb
--- /dev/null
+++ b/packages/backend/src/ee/support/support.controller.spec.ts
@@ -0,0 +1,123 @@
+import { NotFoundException, UnauthorizedException } from '@nestjs/common';
+import { createHmac } from 'crypto';
+import { SupportController, verifyLibredeskSignature } from './support.controller';
+
+const ENV_KEYS = [
+  'SUPPORT_CHAT_URL',
+  'SUPPORT_CHAT_INBOX_ID',
+  'SUPPORT_CHAT_SECRET',
+  'LIBREDESK_API_URL',
+  'LIBREDESK_API_KEY',
+  'LIBREDESK_API_SECRET',
+  'LIBREDESK_WEBHOOK_SECRET',
+];
+
+function withEnv(vars: Record<string, string>, fn: () => void | Promise<void>) {
+  const saved = Object.fromEntries(ENV_KEYS.map((k) => [k, process.env[k]]));
+  for (const k of ENV_KEYS) delete process.env[k];
+  Object.assign(process.env, vars);
+  const restore = () => {
+    for (const k of ENV_KEYS) {
+      if (saved[k] === undefined) delete process.env[k];
+      else process.env[k] = saved[k];
+    }
+  };
+  try {
+    const r = fn();
+    if (r instanceof Promise) return r.finally(restore);
+    restore();
+  } catch (e) {
+    restore();
+    throw e;
+  }
+}
+
+const TRIAGE_ENV = {
+  LIBREDESK_API_URL: 'https://desk.test',
+  LIBREDESK_API_KEY: 'k',
+  LIBREDESK_API_SECRET: 's',
+  LIBREDESK_WEBHOOK_SECRET: 'whsec',
+};
+
+function signed(body: object, secret = 'whsec') {
+  const raw = Buffer.from(JSON.stringify(body));
+  const sig = `sha256=${createHmac('sha256', secret).update(raw).digest('hex')}`;
+  return { req: { rawBody: raw, body }, sig };
+}
+
+function build() {
+  const identity = { widgetSession: jest.fn().mockResolvedValue({ baseUrl: 'b', inboxId: 'i', userJwt: 'j' }) };
+  const triage = { triage: jest.fn().mockResolvedValue(null) };
+  return { controller: new SupportController(identity as any, triage as any), identity, triage };
+}
+
+describe('verifyLibredeskSignature', () => {
+  it('accepts the sha256=<hex> HMAC of the raw body and rejects anything else', () => {
+    const raw = Buffer.from('{"a":1}');
+    const good = `sha256=${createHmac('sha256', 'x').update(raw).digest('hex')}`;
+    expect(verifyLibredeskSignature(raw, good, 'x')).toBe(true);
+    expect(verifyLibredeskSignature(raw, good, 'y')).toBe(false);
+    expect(verifyLibredeskSignature(Buffer.from('{"a":2}'), good, 'x')).toBe(false);
+    expect(verifyLibredeskSignature(raw, undefined, 'x')).toBe(false);
+    expect(verifyLibredeskSignature(raw, 'sha256=short', 'x')).toBe(false);
+  });
+});
+
+describe('SupportController', () => {
+  it('widget is 404 when the chat is not configured', async () => {
+    await withEnv({}, async () => {
+      const { controller } = build();
+      await expect(controller.widget({ user: { sub: 'u1', organizationId: 'o1' } })).rejects.toBeInstanceOf(
+        NotFoundException,
+      );
+    });
+  });
+
+  it('widget returns the session for the caller and their organization', async () => {
+    await withEnv(
+      { SUPPORT_CHAT_URL: 'https://desk.test', SUPPORT_CHAT_INBOX_ID: 'inbox', SUPPORT_CHAT_SECRET: 'sec' },
+      async () => {
+        const { controller, identity } = build();
+        await controller.widget({ user: { sub: 'u1', organizationId: 'o1' } });
+        expect(identity.widgetSession).toHaveBeenCalledWith('u1', 'o1');
+      },
+    );
+  });
+
+  it('webhook is 404 where the triage is not configured', () => {
+    withEnv({}, () => {
+      const { controller } = build();
+      const { req, sig } = signed({ event: 'conversation.created', timestamp: new Date().toISOString() });
+      expect(() => controller.webhook(req, sig)).toThrow(NotFoundException);
+    });
+  });
+
+  it('webhook refuses a bad signature and a stale delivery', () => {
+    withEnv(TRIAGE_ENV, () => {
+      const { controller, triage } = build();
+      const fresh = signed({ event: 'conversation.created', timestamp: new Date().toISOString(), payload: { uuid: 'c1' } });
+      expect(() => controller.webhook(fresh.req, 'sha256=00')).toThrow(UnauthorizedException);
+
+      const old = signed({
+        event: 'conversation.created',
+        timestamp: new Date(Date.now() - 60 * 60_000).toISOString(),
+        payload: { uuid: 'c1' },
+      });
+      expect(() => controller.webhook(old.req, old.sig)).toThrow(UnauthorizedException);
+      expect(triage.triage).not.toHaveBeenCalled();
+    });
+  });
+
+  it('webhook hands conversation.created to the triage and ignores other events', () => {
+    withEnv(TRIAGE_ENV, () => {
+      const { controller, triage } = build();
+      const created = signed({ event: 'conversation.created', timestamp: new Date().toISOString(), payload: { uuid: 'c1' } });
+      expect(controller.webhook(created.req, created.sig)).toEqual({ ok: true });
+      expect(triage.triage).toHaveBeenCalledWith({ uuid: 'c1' });
+
+      const msg = signed({ event: 'message.created', timestamp: new Date().toISOString(), payload: { uuid: 'm1' } });
+      expect(controller.webhook(msg.req, msg.sig)).toEqual({ ok: true });
+      expect(triage.triage).toHaveBeenCalledTimes(1);
+    });
+  });
+});
diff --git a/packages/backend/src/ee/support/support.controller.ts b/packages/backend/src/ee/support/support.controller.ts
new file mode 100644
index 000000000..abb89525a
--- /dev/null
+++ b/packages/backend/src/ee/support/support.controller.ts
@@ -0,0 +1,85 @@
+import {
+  Controller,
+  Get,
+  Headers,
+  HttpCode,
+  Logger,
+  NotFoundException,
+  Post,
+  Req,
+  UnauthorizedException,
+  UseGuards,
+} from '@nestjs/common';
+import { AuthGuard } from '@nestjs/passport';
+import { ApiBearerAuth, ApiExcludeEndpoint, ApiOperation, ApiTags } from '@nestjs/swagger';
+import { createHmac, timingSafeEqual } from 'crypto';
+import { supportChatConfig, supportTriageConfig } from './support-config';
+import { SupportIdentityService } from './support-identity.service';
+import { DeskConversation, SupportTriageService } from './support-triage.service';
+
+/** Webhook deliveries older than this are refused (replay protection). */
+const MAX_WEBHOOK_AGE_MS = 10 * 60_000;
+
+@ApiTags('Support')
+@Controller('api/support')
+export class SupportController {
+  private readonly logger = new Logger(SupportController.name);
+
+  constructor(
+    private readonly identity: SupportIdentityService,
+    private readonly triage: SupportTriageService,
+  ) {}
+
+  /**
+   * GET /api/support/widget: what the frontend needs to load the chat widget
+   * with a verified identity. 404 where the chat is not configured.
+   */
+  @Get('widget')
+  @UseGuards(AuthGuard('jwt'))
+  @ApiBearerAuth()
+  @ApiOperation({ summary: 'Support chat widget settings and signed identity for the current user' })
+  async widget(@Req() req: any) {
+    if (!supportChatConfig()) throw new NotFoundException();
+    return this.identity.widgetSession(req.user.sub, req.user.organizationId ?? null);
+  }
+
+  /**
+   * POST /api/support/webhook: Libredesk `conversation.created` deliveries,
+   * signed with `X-Libredesk-Signature: sha256=<hex HMAC of the raw body>`.
+   * Answers at once; the triage runs in the background (Libredesk does not
+   * retry and times out after 15 s).
+   */
+  @Post('webhook')
+  @HttpCode(200)
+  @ApiExcludeEndpoint()
+  webhook(@Req() req: any, @Headers('x-libredesk-signature') signature?: string) {
+    const cfg = supportTriageConfig();
+    if (!cfg) throw new NotFoundException();
+
+    const raw: Buffer | undefined = req.rawBody;
+    if (!raw || !verifyLibredeskSignature(raw, signature, cfg.webhookSecret)) {
+      throw new UnauthorizedException('Invalid signature');
+    }
+
+    const body = req.body ?? {};
+    const sentAt = Date.parse(body.timestamp);
+    if (!Number.isFinite(sentAt) || Math.abs(Date.now() - sentAt) > MAX_WEBHOOK_AGE_MS) {
+      throw new UnauthorizedException('Stale delivery');
+    }
+
+    if (body.event === 'conversation.created' && body.payload?.uuid) {
+      const conv = body.payload as DeskConversation;
+      void this.triage.triage(conv).catch((err) =>
+        this.logger.warn(`Support triage failed for ${conv.uuid}: ${(err as Error).message}`),
+      );
+    }
+    return { ok: true };
+  }
+}
+
+export function verifyLibredeskSignature(raw: Buffer, header: string | undefined, secret: string): boolean {
+  if (!header || !secret) return false;
+  const expected = Buffer.from(`sha256=${createHmac('sha256', secret).update(raw).digest('hex')}`);
+  const provided = Buffer.from(header.trim());
+  return expected.length === provided.length && timingSafeEqual(expected, provided);
+}
diff --git a/packages/backend/src/ee/support/support.module.ts b/packages/backend/src/ee/support/support.module.ts
new file mode 100644
index 000000000..0da221505
--- /dev/null
+++ b/packages/backend/src/ee/support/support.module.ts
@@ -0,0 +1,18 @@
+import { Module } from '@nestjs/common';
+import { LicenseModule } from '../../license/license.module';
+import { SupportController } from './support.controller';
+import { SupportIdentityService } from './support-identity.service';
+import { SupportTriageService } from './support-triage.service';
+
+/**
+ * SupportModule: the live support chat of the instances we operate (Cloud
+ * and the dedicated instances of enterprise customers), backed by our
+ * Libredesk desk. Loaded only when SUPPORT_CHAT_* or LIBREDESK_* are set,
+ * see support-config.ts; self-hosted installations never load it.
+ */
+@Module({
+  imports: [LicenseModule],
+  controllers: [SupportController],
+  providers: [SupportIdentityService, SupportTriageService],
+})
+export class SupportModule {}
diff --git a/packages/backend/src/main.ts b/packages/backend/src/main.ts
index d0dfbe497..2b4632ac2 100644
--- a/packages/backend/src/main.ts
+++ b/packages/backend/src/main.ts
@@ -50,7 +50,17 @@ async function bootstrap() {
   // body-parser's default `type` matches only application/json, so without
   // this every SCIM POST/PATCH would arrive as an empty body and fail in ways
   // that look nothing like a content-type problem.
-  app.use(json({ limit: '10mb', type: ['application/json', 'application/scim+json'] }));
+  // `verify` keeps the raw bytes of signed webhooks, whose HMAC must be
+  // computed over the body exactly as sent.
+  app.use(
+    json({
+      limit: '10mb',
+      type: ['application/json', 'application/scim+json'],
+      verify: (req: any, _res, buf) => {
+        if (req.url?.startsWith('/api/support/webhook')) req.rawBody = buf;
+      },
+    }),
+  );
   app.use(urlencoded({ extended: true, limit: '10mb' }));
 
   const configService = app.get(ConfigService);
diff --git a/packages/frontend/src/app/providers.tsx b/packages/frontend/src/app/providers.tsx
index 64bb6edfa..e91f1764d 100644
--- a/packages/frontend/src/app/providers.tsx
+++ b/packages/frontend/src/app/providers.tsx
@@ -4,6 +4,7 @@ import { AuthProvider } from '@/lib/auth-context';
 import { ThemeProvider } from '@/lib/theme-context';
 import { ToastProvider } from '@/components/toast';
 import { OnboardingRedirect } from '@/components/onboarding-redirect';
+import { SupportChat } from '@/components/support-chat';
 
 export function Providers({ children }: { children: React.ReactNode }) {
   return (
@@ -12,6 +13,8 @@ export function Providers({ children }: { children: React.ReactNode }) {
         <ToastProvider>
           {/* No DOM; runs the welcome-wizard gate on every navigation. */}
           <OnboardingRedirect />
+          {/* No DOM; loads the support chat where the instance offers it. */}
+          <SupportChat />
           {children}
         </ToastProvider>
       </AuthProvider>
diff --git a/packages/frontend/src/components/support-chat.tsx b/packages/frontend/src/components/support-chat.tsx
new file mode 100644
index 000000000..ed0713f99
--- /dev/null
+++ b/packages/frontend/src/components/support-chat.tsx
@@ -0,0 +1,70 @@
+'use client';
+
+import { useEffect, useRef } from 'react';
+import { useAuth } from '@/lib/auth-context';
+import { support } from '@/lib/api';
+
+interface LibredeskInstance {
+  setUser?: (jwt: string) => void;
+  logout?: () => void;
+  destroy?: () => void;
+}
+
+declare global {
+  interface Window {
+    LibredeskSettings?: Record<string, unknown>;
+    Libredesk?: LibredeskInstance;
+  }
+}
+
+const SCRIPT_ID = 'libredesk-widget';
+
+/**
+ * Live support chat for signed-in users. The backend answers 404 unless this
+ * instance is one we operate (Cloud or a dedicated enterprise instance), so
+ * self-hosted installations never load anything.
+ */
+export function SupportChat() {
+  const { token } = useAuth();
+  const loaded = useRef(false);
+
+  useEffect(() => {
+    if (!token) {
+      if (loaded.current) {
+        window.Libredesk?.logout?.();
+        window.Libredesk?.destroy?.();
+        document.getElementById(SCRIPT_ID)?.remove();
+        delete window.LibredeskSettings;
+        loaded.current = false;
+      }
+      return;
+    }
+
+    let cancelled = false;
+    support
+      .widget(token)
+      .then(({ baseUrl, inboxId, userJwt }) => {
+        if (cancelled) return;
+        if (loaded.current) {
+          // Workspace switch or a new session: refresh the verified identity.
+          window.Libredesk?.setUser?.(userJwt);
+          return;
+        }
+        window.LibredeskSettings = { baseURL: baseUrl, inboxID: inboxId, userJWT: userJwt };
+        const script = document.createElement('script');
+        script.id = SCRIPT_ID;
+        script.async = true;
+        script.src = `${baseUrl}/widget.js`;
+        document.body.appendChild(script);
+        loaded.current = true;
+      })
+      .catch(() => {
+        // Not configured on this instance, or the desk is unreachable.
+      });
+    return () => {
+      cancelled = true;
+    };
+  }, [token]);
+
+  return null;
+}
diff --git a/packages/frontend/src/lib/api.ts b/packages/frontend/src/lib/api.ts
index 780924dff..bad4c8b6c 100644
--- a/packages/frontend/src/lib/api.ts
+++ b/packages/frontend/src/lib/api.ts
@@ -1501,6 +1501,15 @@ export function editionErrorCode(err: unknown): string | null {
   return code === EDITION_REQUIRED || code === SEAT_LIMIT ? code : null;
 }
 
+// Support chat (only on instances we operate; 404 elsewhere)
+export const support = {
+  widget: (token: string) =>
+    request<{ baseUrl: string; inboxId: string; userJwt: string }>('/api/support/widget', {
+      token,
+      skipAutoLogout: true,
+    }),
+};
+
 // License
 export const license = {
   getEdition: (token: string) =>