Freshworks
Customer support · freshworks.com · last read 2026-10-12
Identity
| Legal entity | Freshworks Inc. |
|---|---|
| HQ | US |
| Parent company | — |
| Ultimate ownership | — |
| EU contracting entity | — |
| LEI | 254900ULRGCUEIK0K191 |
| US CLOUD Act reach | Contracting entity incorporated in the US |
| Source | freshworks.com · 2026-10-08 |
Legal entity from the vendor's own terms. LEI, registered country and parent company from the Global LEI Index (GLEIF); ownership is left empty where GLEIF names no parent. The CLOUD Act row is arithmetic over those countries, not an assessment of risk.
Data location
No data-location observation recorded yet.
Subprocessor chain
20 third parties · 8 of the vendor's own group companies · 23 with a country outside the EEA · all read 2026-10-08
| Subprocessor | Country | Purpose |
|---|---|---|
| Amazon Web Services, Inc. | US, EU, AU, IN | Primary cloud infrastructure provider for Freshworks, where all SaaS applications are hosted |
| Appcues, Inc. | US | Product tours, tips, and tutorials for customers |
| Automattic Inc. | US, EU | Akismet spam filtering for Freshdesk Forums |
| Calendly, LLC | US | Booking meetings with Freshworks' teams for onboarding, account setup, and demos |
| Cloudflare, Inc | US, EU, AU, IN | Web Application Firewall, DDoS Protection, CDN, Malware protection and other services to make freshworks products faster and more secure |
| Databricks, Inc. | US, EU, AU, IN | Process and store Customer data within data lake environment (storage, governance, ETL, machine learning, analytics) |
| Dropbox, Inc. | US, EU, AU | Share the quote for signature through DropboxSign |
| e6data Inc | US, EU, AU, IN | High-performance SQL query engine supporting dynamic reporting and analytics features in products |
| FullContact Inc. | US | Contact enrichment with social or publicly available information for customers with an independent FullContact subscription |
| Hertza L.L.C. D/B/A ZeroBounce | EU | Email platform service used to improve customer's email marketing campaign, email validations |
| Inline Manual Ltd. | US | Product tours, tips, and tutorials for customers |
| Mailgun Technologies Inc. | US | Email service provider for Freshsuccess bulk campaigns and individual emails |
| Merge API, Inc. | US, EU | Platform enabling integration between freshworks products and other software applications via Merge Connector API |
| Microsoft Corporation | US, EU, IN, AU | AI functionalities using models derived from Microsoft Azure OpenAI |
| Microsoft Corporation (Cosmos Database) | US, EU, AU, IN | Process customer activity events so they can be reflected in near real-time dashboards within the product |
| Rchilli Inc. | US | Resume parsing in Freshteam to populate Applications Tracking System fields |
| SendGrid, Inc. | US, EU | Transactional email delivery services within FireHydrant |
| Twilio Inc. | US | Platform to programmatically initiate and receive calls and SMS through Freshcaller |
| Wiz Inc. | US, EU, AU, IN | Continuously scan and analyse cloud environments for risks, including Data Security Posture Management, vulnerability management, misconfigurations, and exposure detection |
| Workato Inc. | US, EU | Integration platform to build integrations between Freshworks products and other software; workflow automation provider |
Freshworks's own group companies listed as subprocessors (8)
| Company | Country | Purpose |
|---|---|---|
| Freshworks Australia Pty. Ltd. | AU | support and maintenance |
| Freshworks GmbH | DE | support and maintenance |
| Freshworks SAS | FR | support and maintenance |
| Freshworks Technologies B.V. | NL | support and maintenance |
| Freshworks Technologies Private Limited | IN | support and maintenance |
| Freshworks Technologies Pte. Ltd. | SG | support and maintenance |
| Freshworks Technologies UK Ltd. | GB | support and maintenance |
| Natero Ireland Limited | IE | — |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Processing terms
From the vendor's data processing agreement · read 2026-10-09 · freshworks.com
| Term | What the agreement says |
|---|---|
| Transfer mechanism | SCC module 2 |
| Transfer mechanism | SCC module 3 |
| Transfer mechanism | Swiss FADP clauses |
| Transfer mechanism | UK IDTA |
| Notice of new subprocessors | At least 15 days' prior notice of planned additions or replacements to the subprocessor list |
| Notice of new subprocessors | SCC Clause 9(a) Option 2 (general authorization); process and timings as agreed in the DPA |
| If you object to one | Customer may object promptly in writing; Freshworks either refrains from adding/replacing the subprocessor, or customer may suspend or terminate the Service(s) within 15 days of the notification |
| Breach notification | without undue delay |
| Transfer impact assessment | Parties adopt additional protections required by their transfer impact assessment, if any, described in Schedule 2 |
| Audit | On request, Freshworks provides in a timely manner the information needed to demonstrate its compliance (audit section continues beyond this part) |
| Audit | SCC monitoring/audit rights managed in accordance with the Agreement's provisions, to the extent not conflicting with the SCCs |
| Audit | Third-party certifications/audit reports on written request; inspections by customer, affiliates or independent non-competitor third party on reasonable notice during business hours; customer pays reasonable costs for more than one audit per 12 months |
Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.
Assurance
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| CCPA | Claimed | — | trust.freshworks.com | 2026-10-08 |
| CSA STAR Level 1 · CSA | Claimed | — | trust.freshworks.com | 2026-10-08 |
| Cyber Essentials · CyberEssentials | Claimed | — | trust.freshworks.com | 2026-10-08 |
| Cyber Essentials Plus · CyberEssentialsPlus | Claimed | — | trust.freshworks.com | 2026-10-08 |
| EU-US DPF · DPF | Claimed | — | trust.freshworks.com | 2026-10-08 |
| Swiss-US DPF · DPF | Claimed | — | trust.freshworks.com | 2026-10-08 |
| UK Extension to EU-US DPF · DPF | Claimed | — | trust.freshworks.com | 2026-10-08 |
| ISO/IEC 27001:2022 · ISO27001 | Claimed | — | trust.freshworks.com | 2026-10-08 |
| ISO/IEC 27701:2019 · ISO27701 | Claimed | — | trust.freshworks.com | 2026-10-08 |
| SOC 1 Type 2 · SOC1 | Available on request | — | trust.freshworks.com | 2026-10-08 |
| SOC 2 Type 2 · SOC2T2 | Available on request | — | trust.freshworks.com | 2026-10-08 |
| SOC 3 · SOC3 | Claimed | — | trust.freshworks.com | 2026-10-08 |
| TX-RAMP · TXRAMP | Claimed | — | trust.freshworks.com | 2026-10-08 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
Official registers
| Register | Offering, as the register names it | Status | Level | Valid until | Observed |
|---|---|---|---|---|---|
| Data Privacy Framework List (US) | EU-U.S. Data Privacy Framework · Freshworks, Inc. | Active | HR data, non-HR data | 2026-11-12 | 2026-10-09 |
| Data Privacy Framework List (US) | Swiss-U.S. Data Privacy Framework · Freshworks, Inc. | Active | HR data, non-HR data | 2026-11-12 | 2026-10-09 |
| Data Privacy Framework List (US) | UK Extension to the EU-U.S. DPF · Freshworks, Inc. | Active | HR data, non-HR data | 2026-11-12 | 2026-10-09 |
| Global LEI Index (GLEIF) | FRESHWORKS INC. · FRESHWORKS INC. | ISSUED | US-DE | 2027-06-28 | 2026-10-09 |
- ACN qualified cloud (Italy): checked 2026-10-12, no entry under Freshworks; Freshworks Inc.
- DORA critical ICT third-party providers (ESAs): checked 2026-10-12, no entry under Freshworks; Freshworks Inc.
- Data Privacy Framework List (US): checked 2026-10-12, 3 entries under Freshworks; Freshworks Inc.
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-10-12, no entry under Freshworks; Freshworks Inc.
- FedRAMP Marketplace (US): checked 2026-10-12, no entry under Freshworks; Freshworks Inc.
- SecNumCloud qualified services (ANSSI, France): checked 2026-10-12, no entry under Freshworks; Freshworks Inc.
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
Not yet collected. This row will say not declared only once we have read a lifecycle or security page and found no period stated — see support windows.
Vulnerability reporting: [email protected] (security.txt, no Expires field; read 2026-10-11)
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| certifications | Public | full | 200 | 2026-10-08 |
| dpa | Public | full | 200 | 2026-10-09 |
| subprocessors | Public | full | 200 | 2026-10-08 |
History
Nothing has moved since we started watching this vendor on 2026-10-08. Changes appear here only after a human has reviewed them.