Which security certifications do help desk vendors actually have?

What a certificate covers, and when it was audited, matters more than the badge.

A SOC 2 logo is the least informative thing on a help desk vendor's trust page. Nearly every serious tool shows one. What separates vendors is the line under the logo: which criteria the report covers, which company and products it names, which plan unlocks it, and when the audit period closed.

Take two vendors that both show a SOC 2 Type II badge. Help Scout describes its report as SOC 2 Type 2 for Security and Availability, available on request, and states no ISO 27001 at all. Freshdesk sits under a Freshworks-wide report with bridge letters on request, and posts an ISO/IEC 27001:2022 certificate anyone can download. Same badge. Different evidence.

The gap widens on the documents buyers in regulated industries need most. A HIPAA BAA is a contract, and Help Scout offers one only on its Pro plan. Freshworks limits its BAA to customers that are covered entities or business associates. Neither detail fits inside a checkmark.

I approach certificates the way I approach AI pricing, which every vendor bills in its own unit: read each vendor in its own words, then compare. That is slower than counting badges. It is also the only reading that tells you whether the tool on your shortlist covers the data your team will actually put into it, starting with what the counts across the field look like.

Which security certifications do help desk vendors actually hold?

Of the 25 support tools in the Zazachat matcher, 19 hold SOC 2 Type II and 23 offer a GDPR DPA, while only 12 sign a HIPAA BAA or hold ISO 27001.

Before reading those counts, sort every badge on a vendor's trust page with three plain questions:

1. Is it an independent audit or certificate, or a contract the vendor offers to sign?
2. Does it cover the product you would buy, or a parent company or hosting provider?
3. Is it dated, and does the date still sit ahead of your purchase?

Our check followed the same discipline as our pricing work. The 25 tools in the matcher already carry every published price copied from the vendor's own pricing page with the date it was checked. For certifications, each tool was read on the vendor's own trust page on Oct 29, 2026, and conflicting or unverified statements were not counted.

Two of those rows are not certifications at all. A GDPR DPA is a contract the vendor signs with you, and a HIPAA BAA is the same kind of instrument for health data. The common assumption, repeated in SaaS vendor-selection checklists, treats GDPR, HIPAA and SOC 2 as three badges a provider either has or lacks. In practice, only one of those three is an audit.

The audit itself has more texture than a badge suggests. SOC 2 audit-readiness firms describe SOC 2 Type II as a test of whether controls operated over a period of usually three to twelve months, and they note that only the security criterion is mandatory. A Type II report can therefore cover security alone, or security plus availability, confidentiality, processing integrity or privacy. Only the report itself names which, so ask for it before you compare vendors.

Across the 4 sources I drew on here, the pattern holds. The baseline rows look alike. The upper rows do not. I'd treat the SOC 2 and DPA rows as entry tickets, and spend my review time on the ISO, BAA and AI rows, where roughly half the field drops out.

That split also follows plan tiers, so a security requirement can quietly change your bill. If you are already weighing a higher plan for a BAA, the help desk cost calculator shows each plan's list price as the vendor publishes it, with the date it was checked. The more pressing question is why 19 SOC 2 reports still leave buyers guessing.

What does each vendor's certificate actually cover, and who signs a HIPAA BAA?

KnowledgeOwl cites ISO 27001 only for its AWS data centers and has no SOC 2 report yet, which is why coverage, plan tier and date outweigh the badge itself.

The counts show who claims what. The fine print shows what a buyer actually gets. I read five vendors' trust, HIPAA and PCI pages line by line, and no two of them describe the same thing when they use the same word.

Read across any row and the word changes meaning. Help Scout's SOC 2 names its criteria, Security and Availability, which most badges never do. Freshdesk's and Zoho's reports are parent-company reports: one audit spans many products, so you confirm that yours is named. Zoho SalesIQ's dedicated SOC 2 + HIPAA report covers an audit period that ended on 30-Sep-2024. That is useful evidence. It is not a description of the product you would sign for today.

PCI is where claims and coverage part most sharply. Intercom's own terms say its Services are not PCI DSS compliant. Zoho's PCI attestation lists finance apps, not SalesIQ, and its page showed a validity date of 14-Oct-2026, before our check date. KnowledgeOwl's PCI work covers how it takes its own card payments, not your customers' cards. If agents might see card numbers in chat, none of those three covers that risk.

Contrary to how listicles present it, a HIPAA answer is rarely yes or no. A 2025 vendor-written list of HIPAA help desk tools described every rival's HIPAA support as options, features or add-ons on higher tiers, and named no certification for any of them. That framing hides the two facts a medical practice needs: which plan, and which product.

To check whether a support vendor will sign a HIPAA BAA, work through four steps:

1. Find the vendor's HIPAA document itself, such as Help Scout's HIPAA article or the Freshworks HIPAA configuration guide, rather than relying on a trust badge.
2. Read which plan unlocks it: Pro at Help Scout, Expert at Intercom, Business and Enterprise at KnowledgeOwl.
3. Confirm which products and features it covers. Freshworks names four products; Zoho says the BAA itself specifies the apps; Help Scout adds an AI Feature Healthcare Addendum for AI features.
4. Note when the page was last changed. The Freshworks HIPAA article was modified 2 Aug 2023, and KnowledgeOwl's on 11/19/2025.

In our review, the plan gate mattered more than the yes. A BAA that only exists on the top tier changes which tool fits a five-person clinic. I would shortlist from the plan that unlocks the BAA, then compare prices from there, using our help desk software rankings as the starting list rather than a compliance label. Then comes the harder part: turning this fine print into questions a vendor has to answer in writing.

What should a customer support software RFP and vendor security review include?

Start from a security certifications table for 25 tools, then ask each finalist, in writing, for its report period, certificate scope, BAA plan and PCI product scope.

A founder does not need a 200-question questionnaire to buy a help desk. You need the handful of documents that decide whether the tool can legally and safely hold your customers' data. Ask every finalist for these six items:

1. The SOC 2 Type II report, or a bridge letter if the last period has closed, with the audit period and the criteria it covers.
2. Each ISO certificate, showing which legal entity and which products it names, and its validity date.
3. The BAA for the exact plan you will buy, listing the products and any AI features it covers.
4. A statement on whether PCI DSS covers the product where agents could see card data, not only the vendor's own billing.
5. The DPA, and whether the vendor will sign changes or only its standard form.
6. A named contact who will answer follow-up security questions before and after you sign.

Record the page and the date for every answer. Date every answer you receive, so the same review can be repeated at renewal.

The vendor-risk industry already prices that problem in. Third-party risk firms sell point-in-time cybersecurity assessments built from documents and practices the vendor itself supplies, and they sell continuous monitoring as a separate product. That split tells you a single review has a shelf life. It also tells you the review rests on what the vendor chooses to show.

So keep the review proportional. For a five-person team on a mid-tier plan, items one, three and four carry most of the risk. Items two and five matter more as you add regulated data or sell to enterprise customers who will audit you in turn.

I read these documents as someone who has been on the building side. I have spent 25 years as a founder and operator, launched seven companies, sold three, and hold 6 U.S. patents in real-time communication and session monitoring. That background is why I ask where a chat transcript lives, not only whether a badge exists.

Where a finalist cannot answer an item in writing, record that as its answer and weigh it before you sign. Security terms also follow plan tiers, so check the security row and the price row together. Our customer support software pricing comparison shows which plans you would be comparing once the BAA or certificate requirement has narrowed the field.

If a finalist will not put items one, three or four in writing, that refusal is your answer. If two finalists both pass, the deciding question shifts to something no certificate measures: who picks up when something goes wrong, and you can raise that on a free 15-minute call with me before you sign.

What will separate support vendors on security over the next two years?

Read certificates the way you read AI billing, in each vendor's own terms, because a SOC 2 badge already sits on most trust pages and narrows almost nothing.

KnowledgeOwl shows why. Its security page cites ISO 27001 for the AWS data centers it runs on, not for KnowledgeOwl itself. Its own SOC 2 audit is still at vendor selection. Yet it signs a HIPAA BAA on its Business and Enterprise plans, which matters more to a small clinic than any logo in a footer.

My forecast is that buyers will stop counting badges and start asking three things: what the report covers, when its audit period ended, and which plan unlocks the BAA. A vendor that answers those in writing has earned its place on the shortlist. One that points back at its logo has not.

Pick your two finalists, request their reports this week, and compare scope line by line.