Is Zendesk AI safe for customer data? A defensible enterprise-grade choice, with a privacy posture comparable to its closest competitor.
Plain-English risk rating: 2 of 5
Scope note, added 3 September 2026. This single rating covers plans whose AI is not the same product. From Zendesk’s own pricing: the base Support Team plan includes only Zendesk AI agents, with 5 automated resolutions per agent a month; Suite Team adds AI agents, knowledge base AI and an action builder; Professional adds admin Copilot, an app builder and writing tools; Enterprise adds intelligent triage, auto assist and generative AI for voice. Copilot is a separate add-on at $50 per agent per month on Professional and above. We are splitting this rating by plan. Until we do, read the 2 of 5 as describing the Suite tiers where those features actually run — not the base plan, which has none of them.
Zendesk's AI features (rebranded over 2024-2026 as Advanced AI and the Resolution Platform) sit within Zendesk's broader customer service product and inherit its security posture. Zendesk maintains a no-training default with its AI subprocessors, holds SOC 2 Type II and ISO 27001 certifications, supports HIPAA via BAA on Enterprise tier, and offers EU and AU data residency. Like Intercom Fin, Zendesk can use customer data to train its own models by default (see the training section), and both carry the category-level prompt-injection risk.
Zendesk's October 2024 acquisition of Ultimate.ai consolidated its AI agent capability and was followed by progressive integration into the main product through 2025. The acquisition has not surfaced privacy regression issues as of profile verification, but the integration has expanded the agentic surface of the Zendesk product in ways that warrant the same prompt-injection scrutiny applied to Salesforce Agentforce (post-ForcedLeak) and Microsoft 365 Copilot (post-EchoLeak).
Recommended for
- Sole proprietor: Suite Team at US$55 an agent a month billed yearly (US$69 monthly), with AI agents, knowledge base AI and an action builder. Acceptable for low-volume support; Fin or HubSpot Service Hub may be more cost-effective at this scale.
- Small team (2-10 people): Suite Professional (US$115 an agent a month, billed yearly), with the Copilot add-on if you want agent assistance. The pricing premium over base Zendesk is meaningful; evaluate Fin as a cost-comparison alternative (Fin's per-resolution pricing aligns vendor incentive with delivered value, which Zendesk's per-agent-month pricing does not).
- Regulated industry: Suite Enterprise with BAA, EU or AU residency, and disabled cross-organisation sharing.
- The honest answer for most 1-10 employee businesses using Zendesk: AI features are bundled or available as add-on per tier. The privacy posture is comparable to Intercom Fin; the choice between them is typically driven by existing platform commitment and pricing model rather than privacy posture.
Critical pre-deployment warning (agentic AI in customer-facing contexts)
Zendesk's AI agents (formerly Ultimate.ai) interact directly with end-customers, which puts them in the highest-stakes category of agentic AI deployment. Any AI agent operating in a customer-facing context faces three structural risks that traditional Zendesk macros and templates do not: (a) prompt injection from customer-submitted content, (b) hallucination producing factually-incorrect responses that could create legal exposure (refund commitments, warranty statements, regulatory claims), and (c) escalation-rule gaps where the agent confidently handles a case that should have been escalated to a human.
The right deployment pattern: define explicit escalation rules for sensitive topics (refunds above a threshold, account cancellations, complaints involving regulated subjects, anything mentioning litigation or attorneys), audit the agent's resolution accuracy weekly during initial deployment, and treat the resolution-rate metric with appropriate skepticism (high resolution rates may indicate the agent is closing cases that should have escalated).
Data retention default
- Standard Zendesk retention applies to AI-generated content
- LLM provider retention: see the training section below for which providers Zendesk reaches through zero-data-retention endpoints (corrected 23 October 2026; this line said "zero-retention for paid tiers under Zendesk's contractual arrangements", which our 3 October correction had already withdrawn elsewhere on this page)
- Knowledge base content used for retrieval-grounded AI responses retained per workspace configuration
- Agent interaction logs retained for audit purposes (essential for the deployment pattern above)
Training opt-out
TRAINING: YES FOR ZENDESK'S OWN LABEL MODELS, NO FOR THE GENERATIVE FEATURES. The distinction is Zendesk's own and it carries the whole answer.
Corrected 20 September 2026. This section previously read "NO TRAINING ON CUSTOMER DATA BY DEFAULT across plan tiers", and separately said Zendesk's AI providers were not individually named. Both were wrong and both are withdrawn. See Corrections.
Zendesk's own proprietary models are trained on customer service data, by default, and not only on the higher tiers. Zendesk's AI Data Use Information states that it takes measures to sanitize your data "before using it to train any of our models that could be used by other customers". Those models are not generative – their outputs are labels such as triage, intent and sentiment rather than free text, which is a materially lower risk than generative training – but it is still training on your content, and the resulting model is used for other customers.
What the sanitization does, in Zendesk's words: fields specific to identifiers such as username and email are excluded from the training dataset; a natural language processing pass identifies and removes other identifying information from the remaining free-text fields; and the data is tokenized into vector form that is not human-readable without the associated tokenizer. No training datasets are stored within any Zendesk model.
AI agents – Advanced (Ultimate) is where you control it. Where Service Data is required for model training, Zendesk states that customers directly determine how to sanitize the training dataset.
The generative features are the opposite answer, and this is where Zendesk is strong. They run on third-party LLMs, Zendesk uses pre-trained models, and "no third-party will use your inputs to train their models or otherwise improve their services". For any LLM vendor that is a Zendesk sub-processor, "these vendors cannot use your Service Data to train their models".
The providers are named, on published pages. LLMs hosted on infrastructure platforms – AWS Bedrock, Microsoft Azure, Groq, Fireworks AI – where Zendesk states the LLM provider never accesses your Service Data and is not a sub-processor. LLMs hosted directly by the model provider – OpenAI, Google Gemini, ElevenLabs – reached through zero-data-retention endpoints, with request and response bodies not persisted to any logging mechanism and existing only in memory to serve the request. Zendesk publishes a Sub-processor Policy.
What there is no control for. Zendesk AI features can be turned off per account. There is no documented setting that keeps the label-model features working while excluding your data from their training – turning the feature off is the only lever, and it removes the feature.
Zero Data Retention availability
- Default for generative AI features, at the model providers: Zendesk says it uses “zero data retention” endpoints with providers it calls directly (OpenAI, Google Gemini, ElevenLabs), and that for models it runs on AWS Bedrock, Microsoft Azure, Groq or Fireworks AI “the LLM provider never accesses your Service Data” (Generative AI at Zendesk, edited 13 August 2026). This is described as practice; the contractual commitment in Zendesk's AI Services Addendum, which customers sign, is that LLM providers may use Service Data only “to provide and secure the AI Services”.
- Zero retention does not apply to Zendesk's own copy. Conversations with AI agents that are not handed to a human are stored in your account until you delete them.
- Zendesk's own retention and encryption controls (customer-managed keys, deletion schedules, access logs, data masking) come with the Advanced Data Privacy and Protection add-on, available on Enterprise plans only. Corrected 3 October 2026: this section previously described the provider zero retention as contractual and did not separate it from Zendesk's own storage.
- EU and AU Data Residency available at qualifying tiers
Plan tiers and pricing (read 24 October 2026)
| Tier | Price (USD) | AI features | Suitable for |
|---|---|---|---|
| Support Team | $19 billed yearly; $25 monthly | AI agents: 5 automated resolutions per agent a month | Ticketing only, very small teams |
| Suite Team | $55 billed yearly; $69 monthly | AI agents (5 automated resolutions per agent a month), knowledge base AI, action builder | Small teams |
| Suite Professional | $115 billed yearly; $149 monthly | As Suite Team, plus admin Copilot and writing tools; 10 automated resolutions per agent a month | Mid-size teams |
| Suite Enterprise + Copilot | Contact sales | Adds intelligent triage, auto assist and generative AI for voice | Larger orgs needing SSO, audit |
| Copilot add-on | $50/agent/month, paid yearly | Agent assistance on lower plans | Teams scaling AI capabilities |
Table updated 25 October 2026 from Zendesk's own pricing page. Extra automated resolutions cost US$1.50 each on a committed volume or US$2.00 pay-as-you-go. Suite Growth is no longer sold. The earlier table, kept in our 3 September note, listed Suite Team at $69 and Professional at $149 without saying these were monthly-billing prices.
Jurisdiction
- Primary processor: Zendesk Inc., San Francisco, California, USA
- Cloud infrastructure: AWS primarily
- Third-party AI providers: OpenAI, Google Gemini and ElevenLabs reached directly through zero-data-retention endpoints; other models hosted on AWS Bedrock, Microsoft Azure, Groq and Fireworks AI. Zendesk does not name Anthropic. (Corrected 23 October 2026; this line named OpenAI and Anthropic "under no-training contractual terms".)
- SOC 2 Type II, ISO 27001, HIPAA (Enterprise with BAA), GDPR-compliant
- EU and AU Data Residency available
Breach history (public incidents)
October 2022 — Zendesk Sell breach (pre-AI-era but baseline)
Zendesk disclosed a breach of its Sell product affecting some customer data. Pre-dates the AI feature deployment but represents the platform-level threat baseline.
No publicly-disclosed Zendesk-AI-specific breach as of May 2026.
Category-level risk: Same prompt-injection class affecting Intercom Fin (which has published a transparency document acknowledging attempted bypasses) and Salesforce Agentforce (ForcedLeak, CVSS 9.4, September 2025). Zendesk's retrieval-grounded approach reduces the risk surface compared with pure-LLM systems. The acquisition-and-integration trajectory of Ultimate.ai during 2024-2026 means the platform's agentic surface is expanding rapidly; security disclosure cadence should be monitored.
What this means in plain English for SMB owners
Three honest takeaways:
- Zendesk AI's privacy posture is comparable to Intercom Fin's. Either is a defensible enterprise-grade choice for SMB customer service AI. Zendesk has the longer market presence; Fin has the more transparent published security commitments.
- The Advanced AI add-on pricing is the inflection point. $50/agent/month on top of the base tier needs to deliver measurable resolution-rate uplift to justify itself. Track resolution metrics monthly — and audit a sample of closed cases to verify the agent is genuinely resolving rather than closing cases that should have escalated.
- For customer-facing AI agents, the deployment pattern matters more than the vendor choice. Explicit escalation rules for sensitive topics, weekly audit of agent decisions during initial deployment, and skepticism about high resolution-rate metrics are the operational disciplines that distinguish defensible AI customer service from a future complaint case.
Sources
- Zendesk privacy and security documentation (zendesk.com/trust-center, verified 2026-05-24)
- Zendesk AI feature documentation
- Zendesk acquisition of Ultimate.ai (October 2024) and subsequent integration announcements
- General Vertical SaaS AI category analysis
- Zendesk pricing page: https://www.zendesk.com/pricing/ (read 3 September and 24 October 2026)
- Zendesk help: Zendesk AI Data Use Information (read 3 September 2026)
Related on AI Leakage
- Compare all 29 AI tools in the risk directory — see how Zendesk AI (Advanced AI / Resolution Platform) stacks up against the rest, tier by tier.
- Take the 5-minute “Am I Leaking?” check — a personalised view of your business’s AI exposure.
- Check a prompt before you paste it — our free Data-Safe Prompt Rewriter.
- Shadow AI vs AI leakage — why even approved tools like Zendesk AI (Advanced AI / Resolution Platform) can leak data.
- Get plain-English AI Leakage Alerts — we email you when an AI tool you use changes its data policy or has an incident.
- Get the free AI Acceptable Use Policy template — a plain-English policy with the tool-by-tool risk guide built in.
Compare similar tools: Zendesk AI (Advanced AI / Resolution Platform) is one of 4 tools in AI in customer service and CRM compared, which sets out each one’s rating and what it does with your data, side by side.