Zendesk
Customer support · zendesk.com · last read 2026-11-09
At a glance
- Is Zendesk GDPR compliant?
- No tool is GDPR compliant on its own: compliance depends on what you process with it and how. What follows is what Zendesk itself publishes, each answer linked to its source and the date we read it.
- Does Zendesk have a data processing agreement (DPA)?
- Yes. Zendesk publishes a data processing agreement at zendesk.de. It gives 30 days' notice before a new subprocessor is added. It commits to telling you of a personal data breach within 48 hours. Source and date
- Does Zendesk have a SOC 2 report?
- Zendesk says a SOC 2 Type 2 report is available on request. In Zendesk's words (in German): “Wir führen routinemäßige Audits durch, um aktualisierte SOC 2 Typ II-Berichte zu erhalten, die auf Anfrage und unter NDA verfügbar sind.” We read this on 2026-10-05. Source and date
- Is Zendesk ISO 27001 certified?
- Zendesk states ISO/IEC 27001 certification (2022 edition, as Zendesk names it), and its own page links to the certificate. In Zendesk's words (in German): “Zendesk ist nach ISO 27001:2022 zertifiziert. Zertifikat herunterladen.” We read this on 2026-10-05. Source and date
- Does Zendesk use your data to train AI models?
- For business plans (Zendesk AI (LLM Integrations)): Customer data is never used to train third-party LLMs. For business plans (Zendesk AI (Proprietary Models)): Zendesk's own models may be trained on customer data only to the extent the customer instructs. For business plans (Zendesk generative AI features): Third-party LLMs are not trained on Zendesk data; sub-processor LLM vendors cannot use Service Data to train their models. Source and date
- Does Zendesk offer zero data retention?
- For business plans (Zendesk AI (LLM Integrations)): Third-party LLM providers keep no data beyond the brief time needed to generate a response. For business plans (Zendesk generative AI features): Directly hosted model providers are used through zero data retention endpoints; no LLM provider stores Service Data. Source and date
- Can Zendesk process AI data in the EU?
- For business plans (Zendesk AI (Proprietary Models)): Data can be hosted by region, including Ireland and Germany; processing location is not stated. For business plans (Zendesk generative AI features): European customers can use OpenAI's European endpoints. Source and date
- How does Zendesk transfer personal data out of the EU?
- Zendesk's agreement relies on the EU standard contractual clauses, the EU-U.S. Data Privacy Framework, Binding Corporate Rules and the UK transfer addendum. Zendesk, Inc. is on the official Data Privacy Framework List (status: Active). Source and date
- Does Zendesk offer EU data residency?
- An EU location exists but requires a paid plan or add-on. Plan it needs: Data Center Location add-on, or a Suite including it. Source and date
- Who are Zendesk's subprocessors?
- Zendesk lists 38 third-party subprocessors; 17 of them name at least one processing country outside the EEA. We last read the list on 2026-10-26. The page we read covers only part of the list. Source and date
- How do you report a security vulnerability to Zendesk?
- Zendesk publishes a security.txt at www.zendesk.com naming https://www.zendesk.com/company/policies-and-guidelines/responsible-disclosure-policy/ or https://bugcrowd.com/engagements/zendesk or [email protected]. Source and date
The same questions for any vendor, and the rule behind each: the vendor due diligence checklist.
Identity
| Legal entity | Zendesk, Inc. |
|---|---|
| HQ | US |
| Parent company | — |
| Ultimate ownership | US |
| EU contracting entity | — |
| LEI | 549300SLI6BN94BKKO36 |
| US CLOUD Act reach | Contracting entity incorporated in the US |
| Source | zendesk.de · 2026-10-08 |
Legal entity from the vendor's own terms. LEI, registered country and parent company from the Global LEI Index (GLEIF); ownership is left empty where GLEIF names no parent. The CLOUD Act row is arithmetic over those countries, not an assessment of risk.
Zendesk data residency
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| EU | Paid upgrade | Data Center Location add-on, or a Suite including it | support.zendesk.com | 2026-09-18 |
EU: Page states regional hosting is for 'entitled customers', being purchasers of the Data Center Location Add-On or of a Suite that includes it, and that 'If Customer is not entitled to regional hosting or has not enabled it by selecting a region of choice, Zendesk makes no commitments on the Hosting location of Customer's Service Data.' The add-on covers named functionality only and excludes beta and Early Access offerings.
The same question for every vendor: where SaaS vendors store EU data.
Zendesk's subprocessor list names AWS, Microsoft and Google for hosting or infrastructure. Which SaaS vendors run on which cloud, and the sovereign offerings of each: sovereign clouds.
Subprocessor chain
38 third parties · 48 of the vendor's own group companies · 17 with a country outside the EEA · all read 2026-10-26 · partial: the page we read covers only part of the vendor's subprocessors
| Subprocessor | Country | Purpose |
|---|---|---|
| Aiven Oy | US, BE | Provides search and data analytics functionality. |
| Amazon Web Services Australia Pty. Ltd. | US, CA, GB, DE, AU | Cloud Service Provider |
| Amazon Web Services, Inc. | US, IE, DE, GB, JP, AU | Cloud Service Provider for All Services |
| APIHub, Inc. (aka Clearbit) | US | Provides the marketing data engine used for the Reach functionality available in Zendesk Sell. |
| Baseten Labs, Inc. | — | Provides hosting and inference infrastructure for open-weight AI models. |
| Cartesia AI Inc. | — | Provides text to speech generation for Forethought AI Agents Solve Voice. |
| Cloudflare, Inc. | US | Provides content distribution, network performance optimization, security, abuse prevention, and DNS services for web traffic transmitted to and from the Services. |
| Confluent, Inc. | US | Provides the infrastructure for Kafka clusters where all tickets and Agent activity data flow through. |
| Daily.co | — | Provides voice channel infrastructure. |
| Datadog, Inc. | US, DE | Provides logging platform used for performing analytics, debugging, troubleshooting, auditing, reporting, and detecting and alerting on unexpected application behavior. |
| Deepgram Inc. | — | Supports voice-related features, including generating transcripts and providing analysis and data redaction functionality for recordings and transcripts. |
| Deepgram, Inc. | — | Supports voice-related features, including generating transcripts. |
| ElevenLabs Inc. | — | Provides generative artificial intelligence and natural language processing services for voice-related features. |
| ElevenLabs Inc. | — | Provides generative artificial intelligence and natural language processing services. |
| Fireworks.ai, Inc. | — | Provides hosting and inference infrastructure for open-weight AI models. |
| Forge Technology, Inc. (aka Paragon) | — | Provides integration infrastructure platform services. |
| Functional Software, Inc. (aka Sentry) | US, DE | Provides cross-platform error monitoring and reporting services. |
| Gladia, Inc. | — | Provides natural language processing services for voice-related features. |
| GoodData Corporation | US | Supports analytics functionality in Insights. |
| Google LLC | — | Provides generative artificial intelligence and natural language processing services. |
| Google LLC | — | Supports translation functionality available to Agents, analytics dashboards and features, user authorization within Zendesk WFM, and generative artificial intelligence and natural language processing services. |
| Google LLC | — | Translation functionality, analytics dashboards and features, user authorization within Zendesk WFM, and generative AI and NLP services |
| Google LLC, Google Cloud EMEA Limited | DE, US, BE | Cloud Service Provider for Zendesk QA, AI agents |
| Groq Inc. | — | Provides generative artificial intelligence and natural language processing services. |
| Groq, Inc. | — | Provides hosting and inference infrastructure for open-weight AI models. |
| Halon Security AB | DE | Supports email filtering and security services. |
| Microsoft Corporation | — | Hosts large language models used to provide generative artificial intelligence and natural language processing services (Forethought AI Agents). |
| Microsoft Corporation | — | Hosts large language models used to provide generative artificial intelligence and natural language processing services (Zendesk QA, AI agents, GenAI Functionality). |
| Mistral AI | — | Provides generative artificial intelligence and natural language processing services. |
| MongoDB, Inc. | US, IE, DE, JP, AU, BE | Provides scalable database services used to host select Service Data. |
| OpenAI, L.L.C. | — | Provides generative artificial intelligence and natural language processing services (Forethought AI Agents). |
| OpenAI, L.L.C. | — | Provides generative artificial intelligence and natural language processing services. |
| Pusher Ltd. | US | Supports live event handling and messaging services for system-wide notifications. |
| Raintank, Inc. (aka Grafana Labs) | US, BE | Provides logging and observability functionality. |
| SendGrid, Inc. | US | Provides email campaign services used to send notification emails and dashboards to Agents and End-Users. |
| Snowflake Inc. | US, DE | Provides data warehouse and analytics services and supports advanced Analytics Functionality. |
| Twilio Inc. | US | Supports telecommunication and messaging functionality, including telecommunication infrastructure. |
| Twilio, Inc. | US, IE, AU | Supports telecommunication and messaging functionality, including telecommunication infrastructure. |
Zendesk's own group companies listed as subprocessors (48)
| Company | Country | Purpose |
|---|---|---|
| Base sp. z o. o. (Base spółka z ograniczoną odpowiedzialnością) | PL | — |
| Cleverly, Unipessoal, LDA | PT | — |
| Cleverly, Unipessoal, LDA | PT | — |
| Forethought Technologies Canada, Inc. | CA | — |
| Forethought Technologies, Inc. | US | — |
| FutureSimple Inc. | US | — |
| HyperArc, Inc. | US | — |
| Kabushiki Kaisha Zendesk | JP | — |
| Local Measure Inc. | US | — |
| Local Measure International Pty Ltd. | AU | — |
| Online Media Holdings Ltd. | AU | — |
| Qualitista OÜ | EE | — |
| Smooch Technologies ULC | CA | — |
| Smooch Technologies ULC | CA | — |
| Smooch Technologies US Inc. | US | — |
| Tymeshift doo Novi Sad | RS | — |
| Tymeshift Portugal, Unipessoal Lda | PT | — |
| Tymeshift, Inc. | US | — |
| Ultimate Enterprises Oy | FI | — |
| Ultimate.ai GmbH | DE | — |
| Ultimate.ai Ltd | GB | — |
| Unleash Labs Ltd. | IL | — |
| Unleash Technologies, Inc. | US | — |
| ZD Sub Holdings | US | — |
| Zendesk ApS | DK | — |
| Zendesk ApS | DK, SE | — |
| Zendesk Australia Holding Pty. Ltd | AU | — |
| Zendesk Brasil Software Corporativo LTDA | BR | — |
| Zendesk France SAS | FR | — |
| Zendesk G.K. | JP | — |
| Zendesk GmbH | DE | — |
| Zendesk Incorporated | PH | — |
| Zendesk International Limited | IE | — |
| Zendesk International Limited | IE, IT | — |
| Zendesk Italy S.r.l. | IT | — |
| Zendesk Korea LLC | KR | — |
| Zendesk Netherlands B.V. | NL | — |
| Zendesk Pty., Ltd | AU | — |
| Zendesk Pty., Ltd | AU | — |
| Zendesk Singapore Pte. Ltd. | SG | — |
| Zendesk Sweden AB | SE | — |
| Zendesk Technologies Private Limited | IN | — |
| Zendesk Technologies Spain S.L. | ES | — |
| Zendesk UK Limited | GB | — |
| Zendesk UK Limited | GB | — |
| Zendesk, Inc. | US | — |
| Zendesk, Inc. | US | — |
| Zendesk, S. de R.L. de C.V. | MX | — |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Every subprocessor in the registry, and which vendors name it: subprocessors.
Processing terms
From the vendor's data processing agreement · read 2026-10-09 · zendesk.de
| Term | What the agreement says |
|---|---|
| Transfer mechanism | Binding Corporate Rules |
| Transfer mechanism | EU-U.S. DPF |
| Transfer mechanism | SCC module 2 |
| Transfer mechanism | SCC module 3 |
| Transfer mechanism | UK Addendum |
| Transfer mechanism | other |
| Notice of new subprocessors | At least 30 days before the change, by updating the subprocessor policy; customers can sign up for email notifications |
| Notice of new subprocessors | SCC Clause 9(a) Option 2 (general written authorisation); prior notice period as set out in the DPA's section on the use of subprocessors |
| If you object to one | Object on reasonable data protection grounds by email to [email protected] within 30 days of the policy update; parties negotiate in good faith; if no resolution within 60 days, Zendesk either has the subprocessor not process the customer's data or lets the customer terminate the affected services with a pro rata refund of prepaid fees |
| Obligations passed to subprocessors | each subprocessor commits to protect Personal Data in accordance with the requirements of this DPA; Zendesk remains liable for subprocessors |
| Breach notification | without undue delay and within 48 hours of a confirmed personal data breach |
| Deletion when the service ends | Zendesk deletes Service Data in accordance with the Zendesk Service Data Deletion Policy |
| Getting your data back | On Customer's written request, Zendesk makes Customer's Service Data available for export or download in accordance with the Agreement |
| Requests from data subjects | reasonably assists Customer in responding to data subject requests; refers requests received directly to Customer unless legally prohibited |
| Audit | Third-party audit reports (e.g. SOC 2 Type II, ISO 27001) on written request; if those are insufficient and the law grants the right, customer audit with 30 days' written notice, no more than once a year, during business hours, at Zendesk HQ or an agreed site, at customer's cost |
| Transfer impact assessment | Customer may need to perform a data transfer assessment; Zendesk provides reasonable assistance on request |
| Processing on your instructions | processes Personal Data according to Customer's documented instructions, unless otherwise permitted or required by applicable law; informs Customer without delay if instructions violate data protection law |
| Confidentiality of staff | all employees and contractors committed to an appropriate contractual or statutory duty of confidentiality |
| Security measures | appropriate technical and organisational measures, including the measures in Annex II |
Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.
Which version applies
We found no version number or date in the agreement as we read it.
These terms side by side for every vendor: data processing agreements compared. What vendors give you for a transfer impact assessment: transfer impact assessments.
AI and your data
What Zendesk's own pages state about the data you send its AI products, plan by plan. Compared with other vendors on AI vendors and your data.
| Plans | Term | What the page says | Source | Observed |
|---|---|---|---|---|
| Business Zendesk AI (LLM Integrations) | Training on your data | Not used Customer data is never used to train third-party LLMs | support.zendesk.com | 2026-10-28 |
| Business Zendesk AI (Proprietary Models) | Training on your data | Not used unless you opt in Zendesk's own models may be trained on customer data only to the extent the customer instructs | support.zendesk.com | 2026-10-28 |
| Business Zendesk generative AI features | Training on your data | Not used Third-party LLMs are not trained on Zendesk data; sub-processor LLM vendors cannot use Service Data to train their models | support.zendesk.com | 2026-10-28 |
| Business Zendesk AI (LLM Integrations) | Zero data retention | With its model providers Third-party LLM providers keep no data beyond the brief time needed to generate a response | support.zendesk.com | 2026-10-28 |
| Business Zendesk generative AI features | Zero data retention | With its model providers Directly hosted model providers are used through zero data retention endpoints; no LLM provider stores Service Data | support.zendesk.com | 2026-10-28 |
| Business Zendesk AI (Proprietary Models) | EU processing | EU storage only Data can be hosted by region, including Ireland and Germany; processing location is not stated | support.zendesk.com | 2026-10-28 |
| Business Zendesk generative AI features | EU processing | In the EU European customers can use OpenAI's European endpoints | support.zendesk.com | 2026-10-28 |
| Business Zendesk generative AI features | Model providers | AWS Bedrock | support.zendesk.com | 2026-10-28 |
| Business Zendesk generative AI features | Model providers | ElevenLabs | support.zendesk.com | 2026-10-28 |
| Business Zendesk generative AI features | Model providers | Fireworks AI | support.zendesk.com | 2026-10-28 |
| Business Zendesk generative AI features | Model providers | Google Gemini | support.zendesk.com | 2026-10-28 |
| Business Zendesk generative AI features | Model providers | Groq | support.zendesk.com | 2026-10-28 |
| Business Zendesk generative AI features | Model providers | Microsoft Azure | support.zendesk.com | 2026-10-28 |
| Business Zendesk generative AI features | Model providers | OpenAI | support.zendesk.com | 2026-10-28 |
Assurance
Does Zendesk have a SOC 2 report?
Zendesk says a SOC 2 Type 2 report is available on request. We read this on 2026-10-05.
- Available on request “Wir führen routinemäßige Audits durch, um aktualisierte SOC 2 Typ II-Berichte zu erhalten, die auf Anfrage und unter NDA verfügbar sind.” (in German)
Source: zendesk.de, 2026-10-05
Of the 114 vendors in this registry whose own pages mention SOC 2, 57 say the report is available on request, 1 links to the report itself, and 56 state it without saying how to get it. The type is the one the vendor names.
Is Zendesk ISO 27001 certified?
Zendesk states ISO/IEC 27001 certification (2022 edition, as Zendesk names it), and its own page links to the certificate. We read this on 2026-10-05.
- Certificate published “Zendesk ist nach ISO 27001:2022 zertifiziert. Zertifikat herunterladen.” (in German)
Source: zendesk.de, 2026-10-05
On the same list Zendesk also names ISO/IEC 27017, ISO/IEC 27018 and ISO/IEC 27701. Each standard's page says how it relates to ISO/IEC 27001.
Of the 122 vendors in this registry whose own pages state ISO/IEC 27001, 16 link to the certificate, 43 say it is available on request, and 63 state it without saying how to get it. A certificate names the certification body, the scope and the expiry date: those are the three things to check.
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| BCR | Certificate published | für die Rollen als Auftragsverarbeiter und als Verantwortlicher für die Verarbeitung; geprüft durch den irischen Data Protection Commissioner (mit Peer-Review durch das britische Information Commissioner’s Office und die niederländische Datenschutzbehörde) | zendesk.de | 2026-10-05 |
| CSA CAI · CAIQ | Certificate published | — | zendesk.de | 2026-10-05 |
| CSA CAI-Fragebogen · CAIQ | Certificate published | Selbsteinschätzung; öffentlich verfügbarer Fragebogen im CSA STAR Register | zendesk.de | 2026-10-05 |
| CCPA | Claimed | Zendesk handelt als „Dienstanbieter“ in Bezug auf die Verarbeitung personenbezogener Daten durch unsere Dienste; CCPA-Nachtrag in das DPA integriert | zendesk.de | 2026-10-05 |
| CSA STAR AI Level 1 & 2 · CSA | Claimed | Cloud-Sicherheits- und KI-Governance | zendesk.de | 2026-10-05 |
| Cyber Essentials Plus · CyberEssentialsPlus | Claimed | — | zendesk.de | 2026-10-05 |
| FedRAMP LI-SaaS · FedRAMP | Available on request | Low Impact Software-as-a-Service (LI-SaaS); im FedRAMP Marketplace gelistet; Sicherheitspaket für Abonnent:innen von US-Regierungsbehörden auf Antrag | zendesk.de | 2026-10-05 |
| HDS | Claimed | HDS-Programm | zendesk.de | 2026-10-05 |
| Hébergeur de Données de Santé · HDS | Claimed | Kundendienst- und Engagement-Plattform von Zendesk für Gesundheitsdienstleister in Frankreich; personenbezogene Gesundheitsdaten (PHI) | zendesk.de | 2026-10-05 |
| HIPAA | Claimed | Die Zendesk-KI kann im Rahmen der Business Associate Agreement (Geschäftspartnervereinbarung, BAA) von Zendesk abgedeckt werden. Kund:innen, die eine BAA mit Zendesk abschließen möchten, müssen Zugriff auf das Add-on für Erweiterte Compliance haben. | zendesk.de | 2026-10-05 |
| HIPAA | Claimed | HIPAA-Programm und BAA | zendesk.de | 2026-10-05 |
| HIPAA | Claimed | Konto mit HIPAA-Aktivierung erfordert den Advanced Security Deployed Associated Service oder das Advanced Compliance Deployed Associated Service Add-On, von Zendesk vorgegebene Sicherheitskonfigurationen und eine unterzeichnete Business Associate Agreement (BAA) | zendesk.de | 2026-10-05 |
| ISO 27001:2022 · ISO27001 | Certificate published | — | zendesk.de | 2026-10-05 |
| ISO 27017:2015 · ISO27017 | Certificate published | — | zendesk.de | 2026-10-05 |
| ISO 27018:2019 · ISO27018 | Certificate published | — | zendesk.de | 2026-10-05 |
| ISO 27701:2019 · ISO27701 | Certificate published | — | zendesk.de | 2026-10-05 |
| LGPD | Claimed | Zendesk handelt als ein „Auftragsverarbeiter“ hinsichtlich der Verarbeitung personenbezogener Daten durch unsere Dienste | zendesk.de | 2026-10-05 |
| Financial Services Qualifications System (FSQS) | Available on request | alle Anforderungen (Stufe 1 und Stufe 2) erfüllt, um vollständig im Finanzdienstleister-Qualifizierungssystem für Lieferanten registriert zu werden | zendesk.de | 2026-10-05 |
| Singapore Personal Data Protection Act – PDPA · PDPA | Claimed | Zendesk ist ein durch die Infocomm Development Authority von Singapur (IDA) anerkannter Datenintermediär in seiner Eigenschaft als „Software-as-s-Service“-Dienstleister („SaaS“) | zendesk.de | 2026-10-05 |
| SOC 2 Typ II · SOC2T2 | Available on request | — | zendesk.de | 2026-10-05 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
SecNumCloud, C5, ENS and HDS for every vendor, with the pages for ISO standards, SOC 2 and TISAX: certifications compared.
Official registers
| Register | Offering, as the register names it | Status | Level | Valid until | Observed |
|---|---|---|---|---|---|
| Data Privacy Framework List (US) | EU-U.S. Data Privacy Framework · Zendesk, Inc. | Active | HR data, non-HR data | 2026-12-23 | 2026-10-05 |
| Data Privacy Framework List (US) | Swiss-U.S. Data Privacy Framework · Zendesk, Inc. | Active | HR data, non-HR data | 2026-12-23 | 2026-10-05 |
| Data Privacy Framework List (US) | UK Extension to the EU-U.S. DPF · Zendesk, Inc. | Active | HR data, non-HR data | 2026-12-23 | 2026-10-05 |
| FedRAMP Marketplace (US) | Zendesk Customer Support and Help Desk Platform · Zendesk | FedRAMP Authorized | LI-SaaS | — | 2026-10-04 |
| Global LEI Index (GLEIF) | ZENDESK, INC. · ZENDESK, INC. | LAPSED | US-DE | 2025-06-28 | 2026-10-08 |
- ACN qualified cloud (Italy): checked 2026-11-09, no entry under Zendesk; Zendesk International Limited; Zendesk, Inc.
- ISO 27001 on the basis of IT-Grundschutz (BSI, Germany): checked 2026-11-09, no entry under Zendesk; Zendesk International Limited; Zendesk, Inc.
- CISPE Data Protection Code of Conduct (GDPR Art. 40): checked 2026-11-09, no entry under Zendesk; Zendesk International Limited; Zendesk, Inc.
- DORA critical ICT third-party providers (ESAs): checked 2026-11-09, no entry under Zendesk; Zendesk International Limited; Zendesk, Inc.
- Data Privacy Framework List (US): checked 2026-11-09, 3 entries under Zendesk; Zendesk International Limited; Zendesk, Inc.
- ENS certificates of conformity (CCN, Spain): checked 2026-11-09, no entry under Zendesk; Zendesk International Limited; Zendesk, Inc.
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-11-09, no entry under Zendesk; Zendesk International Limited; Zendesk, Inc.
- FedRAMP Marketplace (US): checked 2026-11-09, 1 entry under Zendesk; Zendesk International Limited; Zendesk, Inc.
- GPAI Code of Practice signatories (European Commission): checked 2026-11-09, no entry under Zendesk; Zendesk International Limited; Zendesk, Inc.
- SecNumCloud qualified services (ANSSI, France): checked 2026-11-09, no entry under Zendesk; Zendesk International Limited; Zendesk, Inc.
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
What an entry on the Data Privacy Framework List covers, and which vendors hold one: EU-US Data Privacy Framework.
Support window
| Product | Support period | State | SBOM | Source | Observed |
|---|---|---|---|---|---|
| Zendesk (SaaS) | — | Service only | unknown | zendesk.com | 2026-09-18 |
Vulnerability reporting: zendesk.com, bugcrowd.com, [email protected] (security.txt, expires 2027-04-16; read 2026-10-17)
How other vendors publish theirs: security.txt across the registry.
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| ai | Public | full | 200 | 2026-10-28 |
| ai-2 | Public | full | 200 | 2026-10-28 |
| dpa | Public | full | 200 | 2026-10-09 |
| subprocessors | Public | partial | 200 | 2026-10-26 |
| tia | Public | full | 200 | 2026-10-20 |
History
| Detected | What moved | Why | Source |
|---|---|---|---|
| 2026-09-18 | EU data location Terms not stated → Paid upgrade Minimum plan, Note rewritten | we read a better page | support.zendesk.com |
Every reviewed change across the registry, newest first: vendor changes.