// Trust & Security Report
Help Scout PBC
Customer support platform (shared inbox, knowledge base, live chat, AI support agents)
Certifications held
5
Maturity
Growth
Trains on your data
Yes
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on helpscout.com“Help Scout is SOC2 Type 2 certified for Security and Availability.”
Verify on helpscout.com“Help Scout maintains ongoing compliance with the U.S. Health Insurance Portability and Accountability Act (HIPAA) and is able to process, maintain, and store protected health information for any entities restricted by these regulations.”
Verify on docs.helpscout.com“We comply with major privacy regulations such as GDPR, UK-GDPR, as well as U.S. regulations like CCPA”
Verify on docs.helpscout.com“We comply with major privacy regulations such as GDPR, UK-GDPR, as well as U.S. regulations like CCPA”
Verify on helpscout.com“Transfers occur pursuant to the EU-U.S. Data Privacy Framework and the UK Extension to the EU-U.S. DPF”
> Show 7 unconfirmed / not-held certifications
source: helpscout.comNo public evidence of ISO 27001 certification on helpscout.com. Help Scout's own security page references only SOC 2 Type 2 and HIPAA compliance. A separate company (k.people) that uses Help Scout Docs holds its own ISO 27001 certificate — that is k.people's certification, not Help Scout's.
source: helpscout.comNo public evidence of PCI DSS certification on helpscout.com. Help Scout processes support conversations and does not appear to be a payment processor.
source: helpscout.comNo public evidence of ISO 27017 certification on helpscout.com.
source: helpscout.comNo public evidence of ISO 27018 certification on helpscout.com.
source: helpscout.comNo public evidence of ISO 42001 certification on helpscout.com. Help Scout publishes an AI Transparency page but does not claim this certification.
source: helpscout.comNo public evidence of CSA STAR certification on helpscout.com.
source: helpscout.comNo public evidence of FedRAMP authorization on helpscout.com.
// Privacy & AI training
Trains on customer data
Yes
Data processing agreement
Offered
Data region
United States only (Amazon Web Services). No EU/EEA data residency option. DPA uses SCCs (EU Standard Contractual Clauses) and EU-US Data Privacy Framework for cross-border transfers. Sub-processors list includes only US and UK entities.
Help Scout does NOT push customer data to OpenAI to retrain the global base model ('We don't take your data and push it back to OpenAI to aid in training of the global foundation model.'). However, they explicitly state: 'We may use limited samples of customer data to evaluate and improve feature quality (for example, when tuning a LoRA adapter for tone or clarity).' LoRA adapter fine-tuning is a form of model training using customer data. There is no self-serve opt-out for this specific data use; the only opt-out is full removal of AI features by contacting help@helpscout.com. AI Answers is disabled by default. Data sent to AI models at inference time includes conversation content, help center articles, and support-related context. AI processing uses OpenAI and Anthropic PBC as sub-processors (both US-based).
// Security controls
Encryption in transit
256-bit SSL/TLS: 'All Help Scout web application communications are encrypted over 256 bit SSL, which is the same level of encryption used by banks and financial institutions.'
docs.helpscout.comEncryption at rest
Data encrypted at rest on AWS infrastructure. Specific algorithm not publicly stated on helpscout.com.
docs.helpscout.comCloud hosting
Amazon Web Services (AWS), United States. 'Help Scout is hosted in AWS and maintains high standards for availability, backups and recovery on behalf of its customers.'
helpscout.comPenetration testing
Annual third-party penetration testing: 'We also use a third party service to do penetration testing at least once a year.' Summary of results available upon request.
docs.helpscout.comSecurity monitoring
24/7/365 engineering monitoring: 'The engineering team at Help Scout monitors ongoing security and performance 24 hours a day, 365 days a year.'
docs.helpscout.comSSO / SAML
SAML SSO available via Auth0. Included on Pro plan; available as add-on for Standard and Plus plans.
helpscout.comVulnerability disclosure
Responsible disclosure via help@helpscout.com; initial response within 24 hours.
helpscout.comHIPAA annual risk assessments
Conducts 'annual risk assessments and employee training as required by HIPAA.'
docs.helpscout.com// Products & data scope
data: Customer conversation data, contact data, support tickets, email and chat interactions
$25/user/month. SOC 2 Type 2 covered. HIPAA not available. SSO available as add-on only.
data: Customer conversation data, contact data, support tickets, multiple channels and inboxes
$45/user/month. SOC 2 Type 2 covered. HIPAA may be available as add-on. SSO available as add-on.
data: Customer conversation data, PHI (if BAA signed), contact data, support tickets
$75/user/month. HIPAA available (BAA required; cannot be customized). SSO included. IP restrictions as add-on. AI features with HIPAA require a separate AI Feature Healthcare Addendum.
data: Conversation content, help center articles, support-related context sent to OpenAI at inference time
$0.75/resolution. Disabled by default. Uses OpenAI foundation models. Limited customer data may be used for LoRA adapter fine-tuning. No EU data residency for AI processing. Requires AI Feature Healthcare Addendum for HIPAA-covered use.
data: Visitor/customer session data, chat messages, help center interactions
Available across all paid plans. AI-powered instant answers available within Beacon using help center content.
// What to watch
- AI LoRA fine-tuning on customer data: Help Scout states 'We may use limited samples of customer data to evaluate and improve feature quality (for example, when tuning a LoRA adapter for tone or clarity).' This constitutes model training using customer data. Their disclaimer that they do not retrain the OpenAI base model is accurate but does not negate this fine-tuning practice.
- No granular opt-out for AI fine-tuning data use: the only available opt-out is full removal of AI features by contacting help@helpscout.com. No self-serve control or per-feature data-use opt-out is offered.
- Trust center (trust.helpscout.com) is gated: requires entering a work email via Conveyor before any security documentation can be accessed. Not fully public.
- HIPAA coverage is restricted to Pro plan ($75/user/mo): Standard and Plus customers are not covered by any BAA and should not use Help Scout for PHI.
- AI features with HIPAA require a separate AI Feature Healthcare Addendum in addition to the standard BAA: customers who sign only the BAA and then enable AI features may create an unaddressed compliance gap.
- ISO 27001 is NOT held by Help Scout. A different company (k.people) that uses Help Scout Docs holds its own ISO 27001 certificate hosted on kpeople.helpscoutdocs.com. These should not be conflated.
- No EU/EEA data residency: all data is hosted on AWS in the United States. GDPR coverage relies on SCCs and the EU-US Data Privacy Framework rather than local storage.
- AI processing sub-processors include Anthropic PBC and OpenAI (both US-based), as well as Google LLC for machine learning. All AI inference occurs in the US.
- DPA is non-negotiable: 'We are not able to make unique agreements with customers.' The published DPA (v.2, May 2026) cannot be customized.
// At a glance
Pricing model
Per-seat SaaS (monthly or annual billing), with AI Answers as separate pay-per-resolution add-on at $0.75/resolution
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Help Scout PBC's own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-06-29. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
trust.helpscout.com