// Trust & Security Report
Freshdesk
by Freshworks Inc.
Freshdesk (AI-powered customer service / help desk), part of the Freshworks platform alongside Freshservice, Freshchat, Freshsales, Freshmarketer, Freshdesk Omni and Freddy AI
Certifications held
11
Maturity
Enterprise
Trains on your data
No
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on trust.freshworks.com“ration Testing (VAPT) Report DOCUMENTS Network Architecture Document COMPLIANCE SOC 2 Type 2 COMPLIANCE TX-RAMP View all documents Risk Profile Data Access Level Impact Level Recovery Time Objective View m”
Verify on trust.freshworks.com“Trust Center lists "SOC 1 Type 2" as an available document.”
Verify on trust.freshworks.com“com Compliance SOC 2 Type 2 Cyber Essentials Cyber Essentials Plus TX-RAMP SOC 3 CCPA EU-US DPF Swiss-US DPF UK Extension to EU-US DPF ISO/IEC 27001 SoA CSA STAR Level 1 ISO/IEC 27001:2022 SOC 1 Type”
Verify on trust.freshworks.com“S DPF Swiss-US DPF UK Extension to EU-US DPF ISO/IEC 27001 SoA CSA STAR Level 1 ISO/IEC 27001:2022 SOC 1 Type 2 ISO/IEC 27701:2019 Documents All Public Private Bulk download Featured Documents DOCUMENTS Applicatio”
Verify on trust.freshworks.com“to EU-US DPF ISO/IEC 27001 SoA CSA STAR Level 1 ISO/IEC 27001:2022 SOC 1 Type 2 ISO/IEC 27701:2019 Documents All Public Private Bulk download Featured Documents DOCUMENTS Application Vulnerability Assessment and”
Verify on trust.freshworks.com“SOC 3 CCPA EU-US DPF Swiss-US DPF UK Extension to EU-US DPF ISO/IEC 27001 SoA CSA STAR Level 1 ISO/IEC 27001:2022 SOC 1 Type 2 ISO/IEC 27701:2019 Documents All Public Private Bulk download Featured”
Verify on trust.freshworks.com“not answered here can go to security@freshworks.com Compliance SOC 2 Type 2 Cyber Essentials Cyber Essentials Plus TX-RAMP SOC 3 CCPA EU-US DPF Swiss-US DPF UK Extension to EU-US DPF ISO/IEC 27001 SoA CSA STAR”
Verify on trust.freshworks.com“Trust Center lists "TX-RAMP" (Texas Risk and Authorization Management Program).”
Verify on freshworks.com“Privacy Notice: "While processing Personal Data we comply with the principles and rules of the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF)..."”
Verify on freshworks.com“venue of the organization depending upon whichever is higher. Our commitment to GDPR We are fully GDPR compliant since the 25th of May 2018. Over the past few months, multiple internal teams have been wor”
Verify on trust.freshworks.com“Vendor and partner documentation state Freshdesk is "audited annually by independent audit firms for ISO 27001, ISO 27701, SOC 2 Type 2, and VAPT." Trust Center also exposes vulnerability assessment documents.”
> Show 1 unconfirmed / not-held certifications
source: trust.freshworks.comNot listed as a certification on the Trust Center cert index. Third-party reviews state HIPAA support is available on enterprise-tier Freshdesk plans (with a BAA), but no direct vendor-domain certification quote was confirmed during this review. Treat as a paid/enterprise add-on, not a held certification.
// Privacy & AI training
Trains on customer data
No
Data processing agreement
Offered
Data region
Multi-region. Freshworks Inc. (US) is the controller; processing occurs in the US, UK, EEA (Germany, Netherlands, France) and India. Customer data hosted in dedicated AWS VPCs; data center region selectable per account (US, EU, India, Australia historically offered).
Freddy AI: Freshworks does NOT use customer data to train third-party hosted generative LLMs (e.g. Azure OpenAI); under contract those providers do not retain data long-term or use it for training/fine-tuning. However, Freshworks' OWN proprietary models can be trained on CONSENTING customer data inside its secured AWS environment, split into Custom Models (your data, your account only) and Collaborative Models (de-identified, cross-customer). This is consent/opt-in based and customers can opt out at any time by emailing support@freshworks.com, after which account-specific models are deleted. So 'trains_on_customer_data' is false by default for third-party LLMs, with an opt-out-able proprietary-model path. Procurement should confirm the AI data-use addendum for their plan.
// Security controls
Bug bounty
Yes, HackerOne. "We have partnered with HackerOne to handle security vulnerabilities identified in our products."
freshworks.comPenetration testing / VAPT
Annual independent VAPT; vulnerability assessment reports available via Trust Center
trust.freshworks.comAccess control
Role-based access via IAM, segregation of duties, two-factor authentication, end-to-end audit trails, IP allowlisting for admin (Teleport)
freshworks.comHosting & resilience
Dedicated AWS VPCs, n+1 multi-AZ active-active, daily cloud snapshots retained 7 days, 24x7 security operations monitoring, cross-geo DR
freshworks.com// Products & data scope
Data it handles: Processes customer support tickets, contact info, and conversation content as a Processor on behalf of the buyer; buyer is controller of end-customer data
Core product. Tiered plans (Free through Enterprise); HIPAA/BAA and advanced compliance gated to higher tiers.
Data it handles: Same support-data scope as Freshdesk plus integrated chat/messaging channels
Bundled omnichannel offering combining Freshdesk + Freshchat capabilities.
Data it handles: Reads ticket/knowledge-base content to generate replies, summaries, translations, insights; may use consenting customer data to train Freshworks proprietary models (opt-out available)
Key data-governance differentiator. Distinct AI data-use FAQ; third-party LLMs are no-retention/no-train, proprietary models are consent-based and opt-out-able.
Data it handles: Separate data scopes per product but share the same platform security controls, Trust Center, and compliance certifications
Same overarching Freshworks compliance umbrella; evaluate per-product DPA if used.
// What to watch
- AI data-use nuance: third-party LLMs do NOT train on customer data, but Freshworks proprietary Freddy models CAN train on consenting customer data (opt-out via support@freshworks.com). Buyers should review the AI addendum and set their consent preference.
- HIPAA is not a Trust Center-listed certification; it is described as an enterprise-tier capability available with a BAA. A held HIPAA attestation is not confirmed by a direct vendor-domain quote.
- Trust Center documents (SOC reports, ISO certifications, CAIQ/HECVAT/SIG) require login or an NDA via SafeBase.
// At a glance
Pricing model
Subscription SaaS, tiered per-agent plans (Free tier through Enterprise); Freddy AI and advanced compliance/HIPAA gated to higher tiers; free trial, no card required
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Freshworks Inc.'s own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-06-27. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
trust.freshworks.com// Trust reports for comparable tools
Other tools in the same category, each with its own sourced report.