Helpora - Internal Request Desk

The problem

Every help desk reports response times. Almost every one of them can be made to report better ones than it earned. An agent adds an internal note and the ticket looks touched. Somebody reassigns it and it looks fresh. An auto-reply goes out and the first-response clock stops before a human has read a word. The status changes and the timer resets.

None of that is fraud. It is what the software allows, and after a while nobody in the room believes the dashboard — including the person presenting it.

Helpora is a self-hosted support desk that refuses. The first reply stamps the clock once, by the first message that actually goes to the requester, and nothing else ever moves it. You cannot close a request nobody answered. You can pause the resolution clock only while genuinely waiting on the person who asked, only after you have written to them, and the pause ends by itself when they reply.

Who this is for

Teams whose response-time numbers are used for something — a contract, a board pack, a renewal conversation — and who would rather have a smaller true number than a larger one nobody trusts. Also: anyone who wants their support conversations in their own database rather than a SaaS, and anyone whose customers should not need an account to ask for help.

Installs on ordinary shared PHP hosting in a couple of minutes.

Who this is NOT for

• Desks that need to pause a first-response timer. Helpora will not let you, on purpose. If that is a requirement, this is the wrong product.

• Anyone wanting a hosted "we take care of everything" SaaS. Self-hosted is the point, which means you run the server, the HTTPS and the backups.

• Large support organisations needing ticket merging, parent/child linking, CSAT surveys, a public knowledge base or a status page. Helpora is a focused single-desk product.

• Anyone who wants the numbers to look good. That is not a joke — it is the honest disqualifier.

What you get

1. You can put the response-time figure in front of a customer without checking it first. Response Met is exported beside the target and the stamp it came from, so any number in a report traces back to the rows that produced it. A late reply stays marked late even after somebody finally answers.

2. Nobody can quietly close what nobody answered. The commonest way a queue gets "cleaned up" is disposal, and it improves every metric at once. Helpora refuses — on the screen, over the REST API and to an AI agent told to tidy the queue.

3. Your customers do not need an account. A reference and a passphrase they choose, and they can read your replies and write back from any browser. Nothing to sign up for, nothing to reset, and one fewer credential in the world.

Objections answered

"Won't the strict rules just make our numbers look worse?" Yes, at first, and that is the product working. What you get for it is a figure you can defend. The dashboard also separates "never answered" from "breached", so the thing most desks hide behind a green average is the second card on the page.

"Will it run on my shared hosting?" Yes. PHP 8+ with PDO, present on virtually all cPanel/Plesk hosts. SQLite for zero setup or MySQL for production. The web installer takes about two minutes.

"Can an AI agent work it?" Yes, over MCP, with a revocable key — and it is held to the same clock. Read-only keys make the write tools invisible rather than merely refused, so a careless prompt cannot settle anything.

"What about the auto-reply everyone sends?" Helpora will send one if you switch it on, and it deliberately does not count as a first response. A desk that counted it would report a flawless response time while nobody had read a single request.

Skeptic FAQ

"Every helpdesk claims accurate SLAs." Then check this one specifically: there is exactly one UPDATE in the entire codebase that writes first_response_at, it is guarded on WHERE first_response_at IS NULL, and the test suite asserts both facts — that it is the only one, and that no status change, reassignment or auto-reply path can reach it. The source ships with the product; that assertion is checkable in a minute.

"We already have a spreadsheet and an inbox." Then you have no first-response time at all, and the first month with real numbers is usually the uncomfortable one. That is the point of buying it.

Honest limitations

• Agent-side desk — not a knowledge base, not a status page, no CSAT surveys

• Single desk, single tenant: one set of logins per installation

• No ticket merging or parent/child linking

• Email needs your own SMTP; there is no SMS

• Reminder jobs need a scheduler — the app runs no background jobs by itself

• Not billing, quoting or invoicing software; money appears nowhere in it

• The clock rules are strict by design and cannot be configured away

Technical details

• PHP 8.1+ | PDO | pdo_sqlite or pdo_mysql | Apache mod_rewrite

• No Composer, no NPM, no build step; explicit require-chain front controller

• CSRF protection on every POST; session auth (password_hash/verify); TOTP two-factor

• All output escaped via htmlspecialchars(); prepared statements throughout

• References: 10 chars from a no-lookalike alphabet (no 0/O/1/I/L), collision-checked

• Passphrase stored only as a hash; never displayed after submission, never exported

• REST API with OpenAPI 3 spec, HMAC-signed webhooks, MCP endpoint with read/write key scopes

• 317 offline assertions + 85 database-level probes, plus three HTTP suites that walk the running app: every page, the four clock rules through the real forms, and the agent surface

• .demo-mode auto-reset guard for public demos; the shipped product never includes it

• Dockerfile included for containerised deployments

Features

• PHP 8.1+ | PDO | pdo_sqlite or pdo_mysql | Apache mod_rewrite

• No Composer, no NPM, no build step; explicit require-chain front controller

• CSRF protection on every POST; session auth (password_hash/verify); TOTP two-factor

• All output escaped via htmlspecialchars(); prepared statements throughout

• References: 10 chars from a no-lookalike alphabet (no 0/O/1/I/L), collision-checked

• Passphrase stored only as a hash; never displayed after submission, never exported

• REST API with OpenAPI 3 spec, HMAC-signed webhooks, MCP endpoint with read/write key scopes

• 317 offline assertions + 85 database-level probes, plus three HTTP suites that walk the running app: every page, the four clock rules through the real forms, and the agent surface

• .demo-mode auto-reset guard for public demos; the shipped product never includes it

• Dockerfile included for containerised deployments

Requirements

PHP 8.0+ with PDO, and MySQL 5.7+/MariaDB 10.x or SQLite 3 — standard shared hosting is enough; no Composer, no Node, no build step. SMTP details if you want email notifications.

Instructions

Upload the contents of app/ to your web root, open the site in a browser, and the built-in installer will create the database, run the schema and set up your admin account — then optionally load the demo data to see it populated before you start.