That sounds like a dodge, but it is the only answer that survives contact with reality. Attestations lapse and get renewed. A vendor that holds a report for its core platform may not have included a newly launched AI feature in the audit scope. EU hosting is sometimes available only above a certain plan. A comparison table frozen at the moment someone wrote it is exactly the kind of source that leads a support lead to tell their customers something that is no longer true. What follows is how to do the check yourself, quickly, and what the two terms actually mean once you get past the badge on the footer.
What does SOC 2 actually tell you about a support vendor?
SOC 2 is a report produced by an independent accounting firm that examines how a company operates its internal controls against the Trust Services Criteria. Security is the common criterion; availability, processing integrity, confidentiality and privacy are optional additions. A Type I report says the controls were designed appropriately at a point in time. A Type II report says an auditor observed those controls operating over a period, which is the one most buyers care about.
Three details decide whether the report means anything for you. First, scope: the report names the systems it covers, and a vendor with several products may have audited only some of them. Second, the criteria included, since a security-only report says nothing formal about privacy practices. Third, the exceptions section, where the auditor lists control failures observed during the period along with management's response. A clean footer badge tells you none of this. Asking for the report, reading the scope paragraph and the exceptions, and noting the period end date tells you all of it. Most established vendors will send it under NDA without friction, and a refusal is itself informative.
What does GDPR ready mean when a vendor uses the phrase?
GDPR readiness is not a certificate anyone issues. The regulation assigns roles: you are almost always the controller for your customers' personal data, and your support platform is a processor acting on your instructions. What you need from a processor is specific and checkable.
You want a data processing agreement containing the Article 28 terms, offered as standard rather than negotiated case by case. You want a published subprocessor list with advance notice of changes, because every analytics tool, hosting provider and model provider in the chain touches your data. You want a lawful transfer mechanism such as the standard contractual clauses if data leaves the EEA, and ideally the option to host in an EU region. You want working mechanisms for data subject rights, meaning you can actually export or delete one person's conversation history without filing a support ticket. You want configurable retention so transcripts are not kept forever by default. And you want a named security contact and a breach notification commitment with a stated timeframe. A vendor that gives you all of that is giving you the tools to be compliant. The compliance itself stays yours.
How do the main AI support platforms compare on this?
The established players are a reasonable place to start, as long as you verify rather than assume. Zendesk, Intercom and Freshdesk are built for larger buyers and maintain formal trust or security portals where current attestations, DPAs and subprocessor lists are published or available on request. Expect regional hosting and advanced admin controls to be features of higher tiers, so read the plan page alongside the security page. Gorgias is oriented toward ecommerce teams and sits close to Shopify data, which makes order and customer records part of the conversation by design. Help Scout and Tidio aim at smaller teams and publish their own security documentation; the scope of what is audited is worth reading carefully, since smaller product surfaces often mean narrower scope.
Chatwoot is the structural outlier. Because it is open source and can be self-hosted, a vendor attestation covering a cloud product says little about an instance you run yourself. Self-hosting hands you the controls and the responsibility together: your patching cadence, your access management, your backups, your logging. That is a genuine advantage for teams with infrastructure skill and a genuine burden for teams without it. If you are weighing a hosted suite against alternatives, a comparison of Zendesk alternatives is a starting point for features, but the security answer still comes from each vendor's own documentation.
What changes when the AI itself is doing the answering?
An AI layer adds parties and artifacts that a traditional helpdesk review would miss. Ask which model providers sit in the chain, because each is a subprocessor handling the content of your customers' messages. Ask whether your conversations are used to train shared models, and whether you can switch that off. Ask how long prompts and completions are retained by the vendor and by the model provider behind it, since those are often different answers.
Then look at the artifacts the AI creates. Transcripts contain whatever a customer typed, which routinely includes order numbers, addresses and occasionally payment details they were never asked for. Voice channels add call recordings and speech transcripts, and bring their own consent questions depending on jurisdiction. Your knowledge base is a data store too: if someone pasted a real customer email into an internal article, the AI can surface it. A review of what lives in your knowledge base before you connect it is a short task that prevents a long problem. Handoff deserves attention as well, because the moment an AI escalates, the conversation lands in a human shared inbox and inherits whatever access rules that inbox has. On messaging channels like WhatsApp, the platform operator becomes another party with its own terms, which is worth reading once rather than assuming.
Which questions should you send a vendor before signing?
Keep it to a single short email and judge the vendor partly on how readily they answer. Ask for the current SOC 2 Type II report under NDA, with the scope and period stated. Ask for the standard DPA and whether it is executable without negotiation. Ask for the subprocessor list and how changes are announced. Ask where data is stored and processed, and whether an EU region is available on the plan you intend to buy. Ask whether customer data trains shared models and whether that is configurable. Ask what retention controls exist for transcripts, recordings and attachments, and how a single person's data is deleted on request. Ask how access is controlled internally, including whether support staff can read your conversations and whether that access is logged. Ask for the breach notification commitment and the security contact. Finally, ask what happens to your data when you cancel. Answers that arrive as links to existing documentation are a better signal than answers written fresh for you, because documentation that already exists tends to reflect a process that already exists.
How does pricing quietly shape your security posture?
This connection gets missed. Per-seat pricing creates a standing incentive to keep accounts to a minimum, and the predictable result is shared logins, a single admin credential circulating in a group chat, and no individual audit trail when something goes wrong. The same pressure discourages giving read-limited accounts to the people who should have them, such as a finance colleague who needs to check one billing thread a month. Per-resolution pricing adds a different distortion, nudging teams to route conversations away from the system that keeps proper records.
Flat pricing removes that pressure. Corebee Pro is $99 per month with unlimited teammates and unlimited AI conversations (fair use), with no per-seat and no per-resolution fees, which means the cost of giving every person their own account with their own permissions is nothing. Its channels run across web chat, email, voice with an AI receptionist that tells callers it is an AI, WhatsApp, Slack, Facebook, Instagram, SMS and Telegram, and it answers from your website and knowledge base, hands off to a human when asked or when uncertain, books meetings through Cal.com or Calendly, and syncs to HubSpot, Salesforce, Pipedrive, monday and Zoho. Setup takes around ten minutes and needs no developer. You can see the full terms on the pricing page. None of that is a substitute for the vendor questions above, which you should send to Corebee exactly as you would send them to anyone else.
How should a small team handle this without a legal department?
Run a short, repeatable process rather than a one-off panic. Start with an inventory: list every system that holds customer conversations and note what personal data each one actually contains. Then minimize, because the cheapest way to protect a data field is not to collect it. Trim the fields your contact forms request and the data your integrations push into the CRM.
Next, get the paperwork in place: a signed DPA with each processor, the subprocessor lists saved somewhere you will look again, and a note of each vendor's security contact. Set retention periods deliberately instead of accepting the default of forever, and set them per channel if transcripts and call recordings carry different risk. Review access on a fixed cadence, quarterly is plenty for most teams, and remove accounts for people who have left. Write a one-page incident plan naming who you call and what you say in the first hour. Keep a simple record of what you process and why, which is the Article 30 record in plain form. Revisit the whole file when you add a channel or swap a vendor. This is perhaps a morning's work to set up and an hour a quarter to maintain, and it puts you in a far stronger position than a badge on a footer ever would.