Intercom
Customer messaging · intercom.com · last read 2026-11-09
At a glance
- Is Intercom GDPR compliant?
- No tool is GDPR compliant on its own: compliance depends on what you process with it and how. What follows is what Intercom itself publishes, each answer linked to its source and the date we read it.
- Does Intercom have a data processing agreement (DPA)?
- Yes. Intercom publishes a data processing agreement at intercom.com. It gives 20 days' notice before a new subprocessor is added. It promises breach notification "without undue delay", with no number of hours. Source and date
- Which version of the Intercom DPA is current?
- On 2026-11-09, Intercom's DPA at intercom.com printed “Effective November 4, 2026”. Our earlier copies, up to 2026-10-19, printed “Effective April 9, 2025”. Source and date
- Does Intercom have a SOC 2 report?
- Intercom states SOC 2 Type 2 on its own page, but does not say there how to get a report. In Intercom's words: “SOC 2 Type II compliant and ISO 27001 certified.” We read this on 2026-10-12. Source and date
- Is Intercom ISO 27001 certified?
- Intercom states ISO/IEC 27001 on its own page, but does not say there how to get the certificate. In Intercom's words: “SOC 2 Type II compliant and ISO 27001 certified.” We read this on 2026-10-12. Source and date
- Where is Intercom's trust center?
- Intercom publishes a page it calls “Trust Center” at trust.intercom.com. Some of its documents sit behind a request or sign-in: the page says “Request access”. Its text appears only after JavaScript runs: a client without it, as most tooling is, gets an empty page. The page mentions SOC 2, ISO 27001, a penetration test, subprocessors, security questionnaires and a DPA. We read it on 2026-11-03. Source and date
- Does Intercom use your data to train AI models?
- For business plans (Intercom AI Products (Fin)): Intercom fine-tunes Fin models on anonymized Customer Data; customers can request an opt-out. For business plans (Intercom AI Products (third party AI providers)): third party AI providers contractually restricted from training on Inputs or Outputs. Source and date
- Does Intercom offer zero data retention?
- For business plans (Intercom AI Products): third party AI providers do not persistently store Inputs and Outputs; safety classifiers may still process Input. Source and date
- Can Intercom process AI data in the EU?
- For business plans (Fin AI Agent, Copilot, and inbox AI features (EU hosted workspaces)): AI data processed within the EU for all new and existing EU-hosted customers; existing EU customers on US processing are moved automatically. For business plans (Intercom AI Products): for EU regionally hosted customers, AI Input regionally hosted via EU providers (Microsoft Azure, AWS, OpenAI). Source and date
- How does Intercom transfer personal data out of the EU?
- Intercom's agreement relies on the EU standard contractual clauses, the EU-U.S. Data Privacy Framework and the UK transfer addendum. Intercom, Inc. is on the official Data Privacy Framework List (status: Active). Source and date
- Does Intercom offer EU data residency?
- An EU location exists but only on the enterprise tier. Plan it needs: Advanced or Expert, annual contract. Source and date
- Who are Intercom's subprocessors?
- Intercom lists 29 third-party subprocessors; 18 of them name at least one processing country outside the EEA. We last read the list on 2026-10-05. Source and date
- How do you report a security vulnerability to Intercom?
- Intercom publishes a security.txt at www.intercom.com naming https://bugcrowd.com/intercom or [email protected]. Source and date
The same questions for any vendor, and the rule behind each: the vendor due diligence checklist.
Identity
| Legal entity | Intercom, Inc. |
|---|---|
| HQ | US |
| Parent company | — |
| Ultimate ownership | — |
| EU contracting entity | Intercom R&D Unlimited Company |
| LEI | — |
| US CLOUD Act reach | Contracting entity incorporated in the US |
| Source | intercom.com · 2026-10-08 |
Intercom data residency
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| EU | Enterprise only | Advanced or Expert, annual contract | intercom.com | 2026-09-18 |
EU: CORRECTION of our 2026-09-17 reading, which recorded this as available at no extra charge from the subprocessor page. Page states: 'Regional Data Hosting is only available to new workspaces on the Advanced and Expert plans', is 'available to customers on a contract', and existing customers 'must create a new workspace'. EU region is AWS eu-west-1, Dublin.
The same question for every vendor: where SaaS vendors store EU data.
Intercom's subprocessor list names AWS, Microsoft and Google for hosting or infrastructure. Which SaaS vendors run on which cloud, and the sovereign offerings of each: sovereign clouds.
Subprocessor chain
29 third parties · 4 of the vendor's own group companies · 18 with a country outside the EEA · all read 2026-10-05
| Subprocessor | Country | If hosted in the EU | Purpose |
|---|---|---|---|
| Ably Realtime Ltd. | AU | — | message delivery service to support real-time delivery of messages via messenger products |
| Ably Realtime Ltd. | EU | EU | message delivery service to support real-time delivery of messages via messenger products (EU data hosting) |
| Amazon Web Services (AWS) | IE | IE | Hosting, storage and processing (including AI processing) of Customer Data (EU data hosting) |
| Amazon Web Services (AWS) | AU, US | — | Hosting, storage and processing (including AI processing) of Customer Data; AWS Bedrock AI processing in the USA |
| Amazon Web Services, Inc. | US | — | Hosting, storage and processing (including AI processing) of Customer Data |
| Anthropic, PBC | US | — | AI processing |
| Cartesia AI, Inc. | US | — | AI processing (text to speech) |
| Cartesia AI, Inc. | EU | EU | AI processing (text to speech) (EU data hosting) |
| Cloudflare, Inc. | IE | IE | TLS protection for custom-domain Intercom Articles; compute and storage infrastructure for Intercom MCP server (EU data hosting) |
| Cloudflare, Inc. | AU | — | TLS protection for customers using a custom domain to host their Intercom Articles |
| Eleven Labs, Inc. | US | — | AI processing (text to speech) |
| Eleven Labs, Inc. | EU | EU | AI processing (text to speech) (EU data hosting) |
| US | — | AI processing | |
| EU | EU | AI processing (EU data hosting) | |
| Google L.L.C. | US | — | AI processing |
| Mailgun Technologies, L.L.C. | US | — | Email delivery services for individual emails and bulk email campaigns |
| Message Systems, Inc. (d/b/a Sparkpost) | US | — | Email delivery services for individual emails and bulk email campaigns |
| Message Systems, Inc. (d/b/a Sparkpost) | EU | EU | Email delivery services via separate Sparkpost EU email infrastructure (EU data hosting) |
| Microsoft Corporation | US | — | AI processing |
| Microsoft Corporation | EU | EU | AI processing (EU data hosting) |
| OpenAI, L.L.C. | US | — | AI processing |
| OpenAI, L.L.C. | EU | EU | AI processing (EU data hosting) |
| PlanetScale Inc. | AU | — | Database storage and caching |
| PlanetScale Inc. | IE | IE | Database storage and caching (EU data hosting) |
| Snowflake Inc. | AU | — | Data warehouse services and processing (including AI processing) |
| Snowflake Inc. | IE | IE | Data warehouse services and processing (including AI processing) (EU data hosting) |
| Twilio, Inc. | US | — | SMS and Phone functionality |
| Twilio, Inc. | US | US | SMS and Phone functionality, only if Customers elect to use SMS and/or Phone (EU data hosting) |
| Twilio, Inc. | US | — | SMS and Phone services (only if Customers elect to use SMS and/or Phone) |
Intercom's own group companies listed as subprocessors (4)
| Company | Country | Purpose |
|---|---|---|
| Intercom R&D Unlimited Company | IE | providing the services and/or for support |
| Intercom Software Australia Pty Ltd | AU | providing the services and/or for support |
| Intercom Software UK Limited | GB | providing the services and/or for support |
| Intercom, Inc. | US | providing the services and/or for support |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Every subprocessor in the registry, and which vendors name it: subprocessors.
Processing terms
From the vendor's data processing agreement · read 2026-10-26 · intercom.com
| Term | What the agreement says |
|---|---|
| Transfer mechanism | EU-U.S. DPF |
| Transfer mechanism | SCC module 1 |
| Transfer mechanism | SCC module 2 |
| Transfer mechanism | SCC module 3 |
| Transfer mechanism | Swiss FADP clauses |
| Transfer mechanism | UK Addendum |
| Transfer mechanism | other |
| Notice of new subprocessors | At least 20 days before adding or replacing Sub-processors; customers must email [email protected] to join the distribution list to receive notice |
| If you object to one | Customer may object on reasonable data-protection grounds within 20 days of notice; the parties work in good faith on an alternative solution; if they can't agree within a reasonable time, Customer may terminate the Agreement |
| Obligations passed to subprocessors | contractual data protection obligations, including appropriate technical and organizational measures, imposed on any sub-processor to the standard required by Applicable Data Protection Legislation |
| Breach notification | without undue delay |
| Deletion when the service ends | If Customer does not request deletion, data is deleted automatically 180 days after termination or expiry; backups deleted 14 days after deletion from live systems, except data that must be kept by law |
| Deletion when the service ends | On Customer's written request, deleted as soon as reasonably practicable and within 30 days; backups deleted 14 days after deletion from live systems; data that Applicable Data Protection Legislation requires Intercom to keep is securely isolated |
| Getting your data back | Upon termination or expiry, at Customer's election, Intercom returns all Customer Personal Data (including copies) to Customer |
| Requests from data subjects | Self-service features to delete or obtain a copy of data at no additional cost; reasonable assistance on request, where possible and at Customer's cost; requests sent directly to Intercom are promptly reported to Customer if Customer can be identified as controller |
| Audit | Documentation (audits/certifications at trust.intercom.com) on written request at no cost; on-site audit at Customer's cost (incl. Intercom's costs), max once annually, scope agreed in advance |
| Audit | Vendor uses external auditors to verify its security measures; certifications and audit standards described at https://trust.intercom.com |
| Transfer impact assessment | Intercom's Transfer Impact Assessment available upon request |
| Processing on your instructions | only in accordance with Customer's documented instructions, as set out in Section 3 (Customer Instructions) |
| Confidentiality of staff | Everyone authorised to process the data (staff, agents, subcontractors) is under a duty of confidentiality, either contractual or statutory; employees sign a confidentiality statement when hired |
| Security measures | appropriate technical and organizational measures against Security Breaches, maintained throughout the term; including the measures in Schedule 2 |
Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.
Which version applies
On 2026-11-09, the agreement printed: Effective November 4, 2026
at intercom.com
In effect from 2026-11-04
This version is in our copies from 2026-10-26. This version was online before the date it gives for taking effect.
Versions in our copies, newest first
Effective November 4, 2026
· In our copies 2026-10-26 – 2026-11-0980 of 257 paragraphs reworded, 38 added, 3 removed (copies of 2026-10-19 and 2026-10-26)Effective April 9, 2025
· In our copies 2026-10-09 – 2026-10-19The first version in our copies
Counted over our stored copies of the page: a paragraph is a line of 60 or more characters, and menus or banners on the page count too. A count says how much of the text moved, not what the change means. Each version change is also in the history.
These terms side by side for every vendor: data processing agreements compared. What vendors give you for a transfer impact assessment: transfer impact assessments.
AI and your data
What Intercom's own pages state about the data you send its AI products, plan by plan. Compared with other vendors on AI vendors and your data.
| Plans | Term | What the page says | Source | Observed |
|---|---|---|---|---|
| Business Intercom AI Products (Fin) | Training on your data | Used unless you opt out Intercom fine-tunes Fin models on anonymized Customer Data; customers can request an opt-out | intercom.com | 2026-10-28 |
| Business Intercom AI Products (third party AI providers) | Training on your data | Not used third party AI providers contractually restricted from training on Inputs or Outputs | intercom.com | 2026-10-28 |
| Business Intercom AI Products | Zero data retention | With its model providers third party AI providers do not persistently store Inputs and Outputs; safety classifiers may still process Input | intercom.com | 2026-10-28 |
| Business Fin AI Agent, Copilot, and inbox AI features (EU hosted workspaces) | EU processing | In the EU AI data processed within the EU for all new and existing EU-hosted customers; existing EU customers on US processing are moved automatically | intercom.com | 2026-10-28 |
| Business Intercom AI Products | EU processing | In the EU for EU regionally hosted customers, AI Input regionally hosted via EU providers (Microsoft Azure, AWS, OpenAI) | intercom.com | 2026-10-28 |
| Business Fin Voice | Model providers | Cartesia AI, Inc. | intercom.com | 2026-10-28 |
| Business Fin Voice | Model providers | ElevenLabs | intercom.com | 2026-10-28 |
| Business Intercom AI Products | Model providers | AWS Bedrock | intercom.com | 2026-10-28 |
| Business Intercom AI Products | Model providers | Anthropic, PBC | intercom.com | 2026-10-28 |
| Business Intercom AI Products | Model providers | Google (Vertex) | intercom.com | 2026-10-28 |
| Business Intercom AI Products | Model providers | Microsoft’s Azure OpenAI | intercom.com | 2026-10-28 |
| Business Intercom AI Products | Model providers | OpenAI, LLC | intercom.com | 2026-10-28 |
Assurance
Does Intercom have a SOC 2 report?
Intercom states SOC 2 Type 2 on its own page, but does not say there how to get a report. We read this on 2026-10-12.
- Claimed “SOC 2 Type II compliant and ISO 27001 certified.”
Source: intercom.com, 2026-10-12
Of the 114 vendors in this registry whose own pages mention SOC 2, 57 say the report is available on request, 1 links to the report itself, and 56 state it without saying how to get it. The type is the one the vendor names.
Is Intercom ISO 27001 certified?
Intercom states ISO/IEC 27001 on its own page, but does not say there how to get the certificate. We read this on 2026-10-12.
- Claimed “SOC 2 Type II compliant and ISO 27001 certified.”
Source: intercom.com, 2026-10-12
On the same list Intercom also names ISO/IEC 27701. Each standard's page says how it relates to ISO/IEC 27001.
Of the 122 vendors in this registry whose own pages state ISO/IEC 27001, 16 link to the certificate, 43 say it is available on request, and 63 state it without saying how to get it. A certificate names the certification body, the scope and the expiry date: those are the three things to check.
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| CCPA | Claimed | — | intercom.com | 2026-10-12 |
| GDPR/CCPA · GDPR | Claimed | — | intercom.com | 2026-10-12 |
| ISO 27001 · ISO27001 | Claimed | — | intercom.com | 2026-10-12 |
| ISO 27701 · ISO27701 | Claimed | — | intercom.com | 2026-10-12 |
| ISO 42001 · ISO42001 | Claimed | AI management system governance across the business | intercom.com | 2026-10-12 |
| AIUC-1 | Claimed | Fin AI Agent | intercom.com | 2026-10-12 |
| SOC 2 Type II · SOC2T2 | Claimed | — | intercom.com | 2026-10-12 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
SecNumCloud, C5, ENS and HDS for every vendor, with the pages for ISO standards, SOC 2 and TISAX: certifications compared.
Official registers
| Register | Offering, as the register names it | Status | Level | Valid until | Observed |
|---|---|---|---|---|---|
| Data Privacy Framework List (US) | EU-U.S. Data Privacy Framework · Intercom, Inc. | Active | HR data, non-HR data | 2026-11-14 | 2026-10-05 |
| Data Privacy Framework List (US) | Swiss-U.S. Data Privacy Framework · Intercom, Inc. | Active | HR data, non-HR data | 2026-11-14 | 2026-10-05 |
| Data Privacy Framework List (US) | UK Extension to the EU-U.S. DPF · Intercom, Inc. | Active | HR data, non-HR data | 2026-11-14 | 2026-10-05 |
| Global LEI Index (GLEIF) | INTERCOM R&D UNLIMITED COMPANY · INTERCOM R&D UNLIMITED COMPANY | ISSUED | IE | 2026-10-27 | 2026-10-08 |
- ACN qualified cloud (Italy): checked 2026-11-02, no entry under Intercom; Intercom R&D Unlimited Company; Intercom, Inc.
- ISO 27001 on the basis of IT-Grundschutz (BSI, Germany): checked 2026-11-09, no entry under Intercom; Intercom R&D Unlimited Company; Intercom, Inc.
- CISPE Data Protection Code of Conduct (GDPR Art. 40): checked 2026-11-09, no entry under Intercom; Intercom R&D Unlimited Company; Intercom, Inc.
- DORA critical ICT third-party providers (ESAs): checked 2026-10-26, no entry under Intercom; Intercom R&D Unlimited Company; Intercom, Inc.
- Data Privacy Framework List (US): checked 2026-11-02, 3 entries under Intercom; Intercom R&D Unlimited Company; Intercom, Inc.
- ENS certificates of conformity (CCN, Spain): checked 2026-11-02, no entry under Intercom; Intercom R&D Unlimited Company; Intercom, Inc.
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-11-02, no entry under Intercom; Intercom R&D Unlimited Company; Intercom, Inc.
- FedRAMP Marketplace (US): checked 2026-11-02, no entry under Intercom; Intercom R&D Unlimited Company; Intercom, Inc.
- GPAI Code of Practice signatories (European Commission): checked 2026-11-09, no entry under Intercom; Intercom R&D Unlimited Company; Intercom, Inc.
- SecNumCloud qualified services (ANSSI, France): checked 2026-11-02, no entry under Intercom; Intercom R&D Unlimited Company; Intercom, Inc.
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
What an entry on the Data Privacy Framework List covers, and which vendors hold one: EU-US Data Privacy Framework.
Support window
| Product | Support period | State | SBOM | Source | Observed |
|---|---|---|---|---|---|
| Intercom (SaaS) | — | Service only | unknown | intercom.com | 2026-09-18 |
| Intercom iOS SDK | — | Not declared | unknown | developers.intercom.com | 2026-10-11 |
Vulnerability reporting: bugcrowd.com, [email protected] (security.txt, expires 2029-03-15; read 2026-10-17)
How other vendors publish theirs: security.txt across the registry.
Documents
Where is Intercom's trust center?
Intercom publishes a page it calls “Trust Center” at trust.intercom.com. Some of its documents sit behind a request or sign-in. Its text appears only after JavaScript runs: a client without it, as most tooling is, gets an empty page. The page mentions SOC 2, ISO 27001, a penetration test, subprocessors, security questionnaires and a DPA. We read it on 2026-11-03. Open trust.intercom.com
- Name “Fin's Trust Center”
- Request step “Request access”
Source: trust.intercom.com, 2026-11-03. Read from the page's text, without a model; every vendor's trust center.
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| ai | Public | full | 200 | 2026-10-28 |
| ai-2 | Public | full | 200 | 2026-10-28 |
| certifications | Public | full | 200 | 2026-10-12 |
| dpa | Public | full | 200 | 2026-10-26 |
| lifecycle | Public | full | 200 | 2026-10-11 |
| subprocessors | Public | full | 200 | 2026-09-17 |
History
| Detected | What moved | Why | Source |
|---|---|---|---|
| 2026-10-26 | DPA in effect from 2025-04-09 → 2026-11-04 | the vendor changed it | intercom.com |
| 2026-09-18 | EU data location No extra charge → Enterprise only Minimum plan set to Advanced or Expert, annual contract Note rewritten | we read a better page | intercom.com |
Every reviewed change across the registry, newest first: vendor changes.