Published August 16, 2026

Zendesk Security and Compliance

Support queues hold some of the most sensitive data in a company, and they are usually reviewed last.

What to check inside your account

Roles and permissions. Who can delete tickets, export data, change automations and merge. On Enterprise, custom roles let you separate these properly.

Two-factor authentication, enforced rather than encouraged.

SSO, so access is removed centrally when somebody leaves. Manual offboarding is where access lingers.

API tokens. Who holds them, and whether integrations use a dedicated service account rather than a person.

The audit log, so you can answer "who changed that" without guessing.

Retention and deletion policies, before somebody in legal asks.

What procurement will ask for

Have these ready before the security review rather than during it.

Certifications and audit reports from the vendor trust centre.

Data residency options and where your instance actually lives.

Sub-processor list.

Encryption in transit and at rest.

Breach notification commitments.

All of that comes from Zendesk. What comes from you is the internal configuration above, and that is the part reviews actually find problems in.

The risk people forget

Every app you install in the agent interface can read ticket data. A marketplace app with broad access is a vendor with access to your customer conversations, and it rarely goes through the same review as the helpdesk itself.

Audit your installed apps once a quarter, and check what each one reads.

Frequently asked questions

Where do I find Zendesk compliance documentation?+

The Zendesk trust centre publishes certifications, audit reports and sub-processor information.

Can we choose where Zendesk stores our data?+

Data residency options exist on certain plans and regions. Confirm for your account rather than assuming.

Fewer tools, fewer reviews

Ticket Merger connects with the narrowest scope that lets it read the queue and merge, and retains no conversation content beyond the comparison window.

Start free trial

14-day free trial. No credit card required.

Keep reading

Security at Ticket Merger: How Your Data Is Handled

What Ticket Merger reads, what it stores, and what it never touches. Native API access, least privilege, and no ticket content kept longer than the comparison needs.

The Zendesk Admin Center: What Lives Where

A map of the Zendesk Admin Center: where to find channels, people, objects, workspaces and account settings, and the settings worth checking first.

Zendesk Duplicate Tickets: Find and Merge Them

Everything about duplicate tickets in Zendesk: how the native merge works, what merging suggestions will and will not catch, and how to merge duplicates automatically.