VendorScore · Comparison · Data-access posture
Evidence dated 2026-10-07, public docs only, not legal advice.
Short answer
Both can read your tickets and conversations by design, and both train their own models on customer data by default. In the scored configurations, Zendesk (55/100) has somewhat less inherent vendor read access than Intercom (47/100): Zendesk support can enter your account only if an admin enables account assumption and its BYOK covers user identity fields, while Intercom has no customer-managed key option.
Higher score = less inherent vendor read access in the scored configuration, not a more secure product. Each score comes from that vendor's VendorScore page.
| Zendesk | Intercom | |
|---|---|---|
| Overall score | 55/100 | 47/100 |
| Scored configuration | Zendesk Suite Enterprise with the Advanced Data Privacy and Protection (ADPP) add-on, including advanced encryption (BYOK). | Intercom Helpdesk + Fin AI Agent on a standard paid workspace with regional hosting (US/EU/AU). No customer-managed key option was found, so the default and scored configuration are the same. |
| Key custody option | ADPP advanced encryption (BYOK via your KMS) covers end-user identity fields only; ticket content stays on Zendesk-managed keys. Key rotation and revocation aren't yet supported. | Intercom holds the keys (TLS 1.2 in transit, 256-bit encryption at rest on AWS). No BYOK, EKM or customer-managed key option found. |
| E2EE / CSE scope | None. Service Data is encrypted at rest in AWS (AES-256) and in transit with TLS 1.2 or higher. | None. |
| AI training default (scored config) | On by default. Zendesk trains generic, cross-account machine learning models on Service Data; we couldn't confirm an opt-out path in public docs. Third-party LLM providers don't train on it. | On by default (opt-out). Intercom's Terms allow Intercom AI model training on Customer Data; Fin models learn from anonymized conversations unless you opt out. |
| EU residency | Yes, with the Data Center Location Add-on (EEA hosting). Without it, Zendesk makes no residency commitment. | Yes: EU hosting on AWS eu-west-1 (Dublin), with listed exceptions for some features and out-of-hours support. |
| DPA link | Zendesk DPA | Intercom DPA |
Dimension scores (key custody, plaintext access, encryption claims, subprocessors, auditability) stay in the full PDFs.
Get the full 5-dimension PDFs — join the waitlist
PDFs aren't for sale yet. Join the waitlist and we'll email yours when it's ready. No calls.
Zendesk support can access your account only if an admin turns on account assumption, which is off by default and can be time-limited; Zendesk's own systems still process ticket content. Intercom restricts access to people with a need-to-know, and for EU- and AU-hosted workspaces urgent out-of-region support requires a customer user to grant impersonation access.
In the scored configurations, Zendesk scores 55/100 (Suite Enterprise with the ADPP add-on) and Intercom 47/100 (Helpdesk + Fin on a standard paid workspace), so Zendesk has somewhat less inherent vendor read access.
Zendesk's advanced encryption (ADPP add-on) uses your KMS, but only for user fields such as name, email address and notes; ticket content stays on Zendesk-managed keys. We found no BYOK, EKM or customer-managed key option for Intercom.
Zendesk uses Service Data to train generic, cross-account machine learning models, and we couldn't confirm an opt-out path; third-party LLM providers don't train on it. Intercom's Terms allow Intercom AI model training, and Fin's custom models learn from anonymized conversations unless you opt out.
Zendesk hosts Service Data in the EEA with the Data Center Location Add-on; without it there's no residency commitment. Intercom offers EU hosting on AWS eu-west-1 (Dublin), with listed exceptions for some features and out-of-hours support.
Every URL cited on this page. Scores, configurations and facts come from the linked VendorScore vendor pages and their reports; nothing here goes beyond them.
This comparison restates the vendor pages for the scored configurations only; default setups usually score lower. A higher score means less inherent vendor read access in that configuration, not a safety rating. VendorScore doesn't certify compliance. Public-docs review only. Not a pen test, not legal advice, not a SOC 2 substitute.