Customer support data in the EU: what to ask your helpdesk vendor
Eight questions that tell you where your support data really lives, who can read it, and what happens when you leave.
A helpdesk holds some of the most personal data a company has: names, emails, phone numbers, order histories, and whatever customers decide to write in a support request. If you serve European customers, where that data lives and who can read it is not a detail. Here are the questions worth asking any vendor, and how ChaosDesk answers them.
1. Where is the data stored, by default?
Many vendors offer EU hosting only on higher plans or as a paid add-on. Ask what the default is on the plan you will actually buy.
ChaosDesk: in the EU, on every plan, including Free.
2. Where are the backups?
Backups are copies of everything. They should be in the same region as the primary data, and encrypted.
ChaosDesk: in the EU, encrypted.
3. Which subprocessors see the data?
Email delivery, file storage, AI and payments usually involve other companies. Ask for the list and for advance notice of changes.
ChaosDesk: a public subprocessor list, with changes announced 30 days ahead.
4. What goes to the AI provider?
Ask whether personal data is masked first, whether your data trains models, and whether you can switch AI off.
ChaosDesk: personal data is masked before text leaves the workspace, it is not used for training, and admins can switch AI off entirely.
5. How is one customer separated from another?
In a shared platform, isolation between workspaces is the most important security property.
ChaosDesk: every record, search index, file, cache key and realtime channel is scoped to its workspace, and secrets are encrypted with a key per workspace.
6. Can you delete a person’s data on request?
GDPR erasure requests need a reliable process, ideally with a second pair of eyes.
ChaosDesk: erasure requests with four-eyes approval, redaction rules and retention policies, plus an access log of who opened which ticket.
7. Is there a DPA, and does it name a breach notification time?
A data processing agreement should be standard, not something you negotiate.
ChaosDesk: a standard DPA with a 48-hour breach notification commitment.
8. What happens when you leave?
You should be able to export everything, and the vendor should delete it after a defined period.
ChaosDesk: export at any time, deletion within 30 days of the end of the contract.
More on how we protect data: security and trust.
