{"@context":"https://certreports.com/llms.txt","vendor":{"slug":"intercom","name":"Intercom","domain":"intercom.com","category":"Customer support","one_liner":null,"trust_center_url":"https://trust.intercom.com/","security_page_url":null,"url":"https://certreports.com/vendors/intercom/security","last_verified_at":"2026-09-17T00:00:00.000Z","claimed":false,"verified_profile":false},"attestations":[{"framework":"hipaa","framework_name":"HIPAA","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states that it will sign a business associate agreement on its trust centre (Vanta) as of 17 Sep 2026.","kind":null,"status_text":"Vendor displays a HIPAA badge on its trust centre (claim; BAA availability not yet captured)","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/intercom/hipaa","evidence":[{"source_type":"trust_center","source_name":"Intercom trust centre (Vanta)","url":"https://trust.intercom.com/","fetched_at":"2026-09-17 16:27:34.467948+00","content_hash":"feb1420ae0d39afdcb9bca46bea8cefe85f3b48686f80268547220cc64bd2f23","wayback_url":null,"quote":"HIPAA","confidence":1}]},{"framework":"soc-2","framework_name":"SOC 2","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a SOC 2 Type II report on its trust centre (Vanta) as of 17 Sep 2026.","kind":null,"status_text":"Vendor states SOC 2 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/intercom/soc-2","evidence":[{"source_type":"trust_center","source_name":"Intercom trust centre (Vanta)","url":"https://trust.intercom.com/","fetched_at":"2026-09-17 16:27:34.467948+00","content_hash":"feb1420ae0d39afdcb9bca46bea8cefe85f3b48686f80268547220cc64bd2f23","wayback_url":null,"quote":"SOC 2","confidence":1}]},{"framework":"gdpr","framework_name":"GDPR","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a data processing agreement on its trust centre (Vanta) as of 17 Sep 2026.","kind":null,"status_text":"Vendor states GDPR on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/intercom/gdpr","evidence":[{"source_type":"trust_center","source_name":"Intercom trust centre (Vanta)","url":"https://trust.intercom.com/","fetched_at":"2026-09-17 16:27:34.467948+00","content_hash":"feb1420ae0d39afdcb9bca46bea8cefe85f3b48686f80268547220cc64bd2f23","wayback_url":null,"quote":"GDPR","confidence":1}]},{"framework":"iso-27001","framework_name":"ISO/IEC 27001","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an ISO/IEC 27001 certificate on its trust centre (Vanta) as of 17 Sep 2026.","kind":null,"status_text":"Vendor states ISO 27001:2022 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/intercom/iso-27001","evidence":[{"source_type":"trust_center","source_name":"Intercom trust centre (Vanta)","url":"https://trust.intercom.com/","fetched_at":"2026-09-17 16:27:34.467948+00","content_hash":"feb1420ae0d39afdcb9bca46bea8cefe85f3b48686f80268547220cc64bd2f23","wayback_url":null,"quote":"ISO 27001:2022","confidence":1}]},{"framework":"csa-star","framework_name":"CSA STAR","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a CSA STAR Level 1 self-assessment on its trust centre (Vanta) as of 17 Sep 2026.","kind":null,"status_text":"Vendor states CSA Star for AI on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/intercom/csa-star","evidence":[{"source_type":"trust_center","source_name":"Intercom trust centre (Vanta)","url":"https://trust.intercom.com/","fetched_at":"2026-09-17 16:27:34.467948+00","content_hash":"feb1420ae0d39afdcb9bca46bea8cefe85f3b48686f80268547220cc64bd2f23","wayback_url":null,"quote":"CSA STAR","confidence":1}]},{"framework":"iso-27701","framework_name":"ISO/IEC 27701","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an ISO/IEC 27701 certificate on its trust centre (Vanta) as of 17 Sep 2026.","kind":null,"status_text":"Vendor states ISO 27701 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/intercom/iso-27701","evidence":[{"source_type":"trust_center","source_name":"Intercom trust centre (Vanta)","url":"https://trust.intercom.com/","fetched_at":"2026-09-17 16:27:34.467948+00","content_hash":"feb1420ae0d39afdcb9bca46bea8cefe85f3b48686f80268547220cc64bd2f23","wayback_url":null,"quote":"ISO 27701","confidence":1}]},{"framework":"iso-42001","framework_name":"ISO/IEC 42001","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an ISO/IEC 42001 certificate on its trust centre (Vanta) as of 17 Sep 2026.","kind":null,"status_text":"Vendor states ISO/IEC 42001:2023 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/intercom/iso-42001","evidence":[{"source_type":"trust_center","source_name":"Intercom trust centre (Vanta)","url":"https://trust.intercom.com/","fetched_at":"2026-09-17 16:27:34.467948+00","content_hash":"feb1420ae0d39afdcb9bca46bea8cefe85f3b48686f80268547220cc64bd2f23","wayback_url":null,"quote":"ISO/IEC 42001:2023","confidence":1}]},{"framework":"iso-27018","framework_name":"ISO/IEC 27018","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an ISO/IEC 27018 certificate on its trust centre (Vanta) as of 17 Sep 2026.","kind":null,"status_text":"Vendor states ISO 27018 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/intercom/security","evidence":[{"source_type":"trust_center","source_name":"Intercom trust centre (Vanta)","url":"https://trust.intercom.com/","fetched_at":"2026-09-17 16:27:34.467948+00","content_hash":"feb1420ae0d39afdcb9bca46bea8cefe85f3b48686f80268547220cc64bd2f23","wayback_url":null,"quote":"ISO 27018","confidence":1}]},{"framework":"dpf","framework_name":"EU-US Data Privacy Framework","state":"verified_registry","state_label":"Verified","sentence":"Listed in the Data Privacy Framework list as of 17 Sep 2026.","kind":"listing","status_text":"Active: EU-US Certification, SW-US Certification, UK Extension Certification","issued_at":"2016-10-13","expires_at":"2026-11-14","period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"dpf","url":"https://certreports.com/vendors/intercom/security","evidence":[{"source_type":"registry","source_name":"Data Privacy Framework list","url":"https://www.dataprivacyframework.gov/participant/5893","fetched_at":"2026-09-17 15:49:13.307981+00","content_hash":"8a163bd0c0692946267addc113639cf7073d968b7d59de28bdf2b18e11d2639f","wayback_url":null,"quote":"Intercom, Inc.: Active: EU-US Certification, SW-US Certification, UK Extension Certification","confidence":1}]},{"framework":"ccpa","framework_name":"CCPA / CPRA","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an CCPA / CPRA privacy notice on its trust centre (Vanta) as of 17 Sep 2026.","kind":null,"status_text":"Vendor states CCPA on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/intercom/security","evidence":[{"source_type":"trust_center","source_name":"Intercom trust centre (Vanta)","url":"https://trust.intercom.com/","fetched_at":"2026-09-17 16:27:34.467948+00","content_hash":"feb1420ae0d39afdcb9bca46bea8cefe85f3b48686f80268547220cc64bd2f23","wayback_url":null,"quote":"CCPA","confidence":1}]},{"framework":"hds","framework_name":"HDS","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an HDS certificate on its trust centre (Vanta) as of 17 Sep 2026.","kind":null,"status_text":"Vendor states HDS on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/intercom/security","evidence":[{"source_type":"trust_center","source_name":"Intercom trust centre (Vanta)","url":"https://trust.intercom.com/","fetched_at":"2026-09-17 16:27:34.467948+00","content_hash":"feb1420ae0d39afdcb9bca46bea8cefe85f3b48686f80268547220cc64bd2f23","wayback_url":null,"quote":"HDS","confidence":1}]}],"brief":{"summary":"As of 17 Sep 2026, Intercom states on its trust centre that it holds SOC 2, though no report details are provided in this evidence. As of 17 Sep 2026, Intercom displays a HIPAA badge on its trust centre, but BAA availability is not yet captured, so this should be confirmed directly with the vendor. As of 17 Sep 2026, Intercom states on its trust centre that it holds ISO/IEC 27001:2022, ISO/IEC 27701, ISO/IEC 42001:2023, ISO/IEC 27018, GDPR, CCPA/CPRA, CSA STAR for AI, and HDS, all as vendor statements rather than independently verified records in this evidence set. As of 17 Sep 2026, Intercom is listed in the EU-US Data Privacy Framework registry with an active EU-US Certification, SW-US Certification, and UK Extension Certification, issued 13 Oct 2016 and expiring 14 Nov 2026. No public evidence found for any additional frameworks beyond those listed as of 17 Sep 2026.","bullets":["HIPAA: vendor displays a HIPAA badge on its trust centre as of 17 Sep 2026; BAA availability not yet captured.","SOC 2: vendor states on its trust centre that it holds SOC 2, as of 17 Sep 2026 (no report details in evidence).","EU-US Data Privacy Framework: listed in DPF registry as of 17 Sep 2026, active certification issued 13 Oct 2016, expiring 14 Nov 2026."],"model":"claude-sonnet-5","generated_at":"2026-09-17 18:34:33.66488+00"},"legal_docs":[{"kind":"subprocessors","url":"https://trust.intercom.com/","availability":"public","detail":"14 subprocessors listed on the trust centre","as_of":"2026-09-17"},{"kind":"privacy","url":"https://www.intercom.com/legal/privacy","availability":"public","detail":null,"as_of":"2026-09-17"}],"subprocessors":[{"name":"Ably","domain":"ably.com","purpose":"Message delivery service","location":"USA, EU or Australia dependent upon customers selected region","vendor_url":null},{"name":"Amazon Web Services, Inc.","domain":"amazon.com","purpose":"Hosting, storage and processing (including AI processing) of Customer Data","location":"USA or EU dependent upon customer's selected region","vendor_url":"https://certreports.com/vendors/amazon/security"},{"name":"Anthropic, PBC","domain":"anthropic.com","purpose":"Provides large language model processing via APIs for customers using Intercom’s AI Products (USA).","location":"USA","vendor_url":null},{"name":"Cartesia AI, Inc.","domain":"cartesia.ai","purpose":"AI processing (text to speech) ","location":"USA or EU dependent upon customer's selected region","vendor_url":null},{"name":"Cloudflare, Inc.","domain":"cloudflare.com","purpose":"Transport Layer Security (\"TLS\") protection for customers using a custom domain to host their Intercom Articles. Compute and storage infrastructure for Intercom MCP server (Ireland)","location":"USA or EU dependent upon Customer's selected region","vendor_url":"https://certreports.com/vendors/cloudflare/security"},{"name":"Eleven Labs, Inc.","domain":"elevenlabs.io","purpose":"AI Processing (text to speech)","location":"USA or EU dependent upon customer's selected region","vendor_url":null},{"name":"Google","domain":"google.com","purpose":"Provides AI processing","location":"USA or EU dependent upon customer's selected region","vendor_url":null},{"name":"Mailgun Technologies, LLC","domain":"mailgun.com","purpose":"Email delivery services for individual emails and bulk email campaigns initiated from Intercom's services","location":"USA","vendor_url":"https://certreports.com/vendors/mailgun/security"},{"name":"Message Systems, Inc. (d/b/a Sparkpost)","domain":"bird.com","purpose":"Email delivery services for individual emails and bulk email campaigns initiated from Intercom's services","location":"USA","vendor_url":"https://certreports.com/vendors/bird/security"},{"name":"Microsoft Corporation (EU)","domain":"microsoft.com","purpose":"AI processing","location":"USA or EU dependent upon customer's selected region","vendor_url":"https://certreports.com/vendors/microsoft/security"},{"name":"OpenAI, L.L.C.","domain":"openai.com","purpose":"AI processing","location":"USA or EU dependent upon customer's selected region","vendor_url":"https://certreports.com/vendors/openai/security"},{"name":"PlanetScale Inc.","domain":"planetscale.com","purpose":"Database storage and caching","location":"USA or EU dependent upon customer's selected region","vendor_url":"https://certreports.com/vendors/planetscale/security"},{"name":"Snowflake Inc.","domain":"snowflake.com","purpose":"Data warehouse services and processing (including AI processing)","location":"USA or EU dependent upon customer's selected region","vendor_url":"https://certreports.com/vendors/snowflake/security"},{"name":"Twilio, Inc.","domain":"twilio.com","purpose":"SMS and Phone functionality","location":"USA","vendor_url":"https://certreports.com/vendors/twilio/security"}],"disclaimer":"CertReports indexes public evidence. A missing framework means no public evidence was found at the last check, not that the vendor is non-compliant. SOC 2 is a report, not a certification; HIPAA has no certification.","generated_at":"2026-09-18T17:28:42.185Z"}