Customer support data in the EU: what to ask your helpdesk vendor
Eight questions that tell you where your support data really lives, who can read it, and what happens when you leave.
A helpdesk holds some of the most personal data a company has: names, emails, phone numbers, order histories, and whatever customers decide to write in a support request. If you serve European customers, where that data lives and who can read it is not a detail. Here are the questions worth asking any vendor, and how ChaosDesk answers them.
1. Where is the data stored, by default?
Several vendors tie the choice of region to a higher plan. Zendesk’s Data Center Location add-on, which is how you pick the EEA, is “available and free of charge for Zendesk Suite Professional or higher plans” and has to be switched on by your account representative (Zendesk help centre, checked 2026-11-09). Intercom’s regional data hosting is “only available to new workspaces on the Advanced and Expert plans” and is arranged through sales (Intercom help centre, checked 2026-11-09). Ask what the default is on the plan you will actually buy, and whether an existing workspace can be moved at all.
ChaosDesk: in the EU, on every plan, including Free. Enterprise can additionally choose another region by contract.
2. Where are the backups?
Backups are copies of everything. They should be in the same region as the primary data, and encrypted.
ChaosDesk: in the EU, encrypted.
3. Which subprocessors see the data?
Email delivery, file storage, AI and payments usually involve other companies. Ask for the list and for advance notice of changes.
ChaosDesk: a public subprocessor list, with changes announced 30 days ahead.
4. What goes to the AI provider?
Ask whether personal data is masked first, whether your data trains models, and whether you can switch AI off.
ChaosDesk: personal data is masked before text leaves the workspace, it is not used for training, and admins can switch AI off entirely.
5. How is one customer separated from another?
In a shared platform, isolation between workspaces is the most important security property.
ChaosDesk: every record, search index, file, cache key and realtime channel is scoped to its workspace, and secrets are encrypted with a key per workspace.
6. Can you delete a person’s data on request?
GDPR erasure requests need a reliable process, ideally with a second pair of eyes.
ChaosDesk: erasure requests with four-eyes approval, redaction rules and retention policies, plus an access log of who opened which ticket.
7. Is there a DPA, and does it name a breach notification time?
A data processing agreement should be standard, not something you negotiate.
ChaosDesk: a standard DPA with a 48-hour breach notification commitment.
8. What happens when you leave?
You should be able to export everything, and the vendor should delete it after a defined period.
ChaosDesk: export at any time, deletion within 30 days of the end of the contract.
More on how we protect data: security and trust.
Zendesk is a trademark of Zendesk, Inc. Other product names are trademarks of their respective owners. ChaosDesk is not affiliated with Zendesk or any vendor named here.
