# Help Scout

> Brings email, chat and social channels together in one shared inbox and puts a knowledge base beside it, from which a chatbot answers customer questions directly.

- Vendor: Help Scout PBC
- Canonical URL: https://www.convios.com/en/toolbox/help-scout
- Language version: https://www.convios.com/de/werkzeugkasten/help-scout
- Area: Service & support · Cluster: helpdesk for small teams
- Role: Off-the-shelf product · Origin: Established, AI retrofitted
- As of: 2026-09-09 · Reviewed: 2026-09-09 · Author: Dr. Oliver Gausmann, Convios GmbH
- Toolbox: https://www.convios.com/en/toolbox — Markdown: https://www.convios.com/en/toolbox.md

## Verdict

Prevents falling behind: A shared inbox creates no edge, because every competitor can buy the same one. Work without one and you lose ownership of a request the moment the first responder drops out, and you fall behind a response time customers already assume. Alongside it Help Scout puts a chatbot that answers end customers directly and is billed at 0.75 USD per resolved case. That moves a definition onto the invoice that nobody needed before: what counts as resolved is set by the vendor, and it is measured by the customer not asking again. Put that measure next to your own before you switch it on, because otherwise it becomes the only one.

## Suitability by company size

- Solo: suitable with caveats — The free plan covers five users, one inbox, one knowledge base and 100 contacts a month. Someone working alone shares no inbox, but does get a public help site with a contact form without a contract and without a payment method. From the first paid plan at 25 USD per seat per month the price grows faster than the value for one person.
- Mid-market: suitable — This is where the tool belongs. Standard at 25 USD and Plus at 45 USD per seat per month cover several inboxes and knowledge bases, workflows, response targets and the channels up to WhatsApp. Three limits belong on the same note: sign-in through your own directory service costs extra on both plans, the vendor describes no reviewable change log anywhere in public, and no plan offers European hosting.
- Enterprise: not suitable — Three points argue against it, and none of them is a question of features. Sign-in through your own directory service and restriction to defined address ranges are included only on the Pro plan, which requires ten seats at 75 USD and therefore starts at 9,000 USD a year. A log of who changed which setting and when appears nowhere in the public documentation; the only documented view lists the devices currently signed in. And processing runs in the United States, with no European alternative on any plan.

## Vendor staying power

Established: The vendor has been in market since 2011, publishes dated product notes and runs a public incident archive with an API. Legal documents are maintained, though unevenly: the data processing amendment carries the May 2026 version, the subprocessor list the state of January 2025. None of that supports a statement about financial viability, and none is made here.

- Contracting entity: Help Scout PBC, a Delaware public benefit corporation; Delaware law applies with venue in Wilmington and an arbitration clause under the JAMS rules. The contract annex gives a mailbox address in Boston, Massachusetts, while the official Data Privacy Framework participant list gives Nashville, Tennessee (source: https://www.helpscout.com/company/legal/terms-of-service/, as of 2026-09-09)
- Time in market and size, by the vendor's own account: by the vendor's own account founded in 2011, working fully remotely from more than 115 cities, more than 12,000 customer-facing teams served and more than 950 million customer conversations handled; the vendor states no measurement method for any of these figures (source: https://www.helpscout.com/about/, as of 2026-09-09)
- Ongoing development: dated product notes at a monthly cadence, ten entries between 18 May 2026 and 11 August 2026, most recently a customer portal for several contacts of one company on 11 August 2026 and two-way SMS over your own Twilio numbers on 4 August 2026 (source: https://updates.helpscout.com/, as of 2026-09-09)
- Public incident record: the incident archive reaches openly back to 9 July 2025 and lists 33 entries for the period 1 January 2026 to 31 August 2026, among them one major on 14 July 2026 and one critical on 20 April 2026; the vendor's own page footer separately states 99.99 percent availability without naming a reference period (source: https://status.helpscout.com/history, as of 2026-09-09)
- State of the legal documents: the data processing amendment carries version 2 dated May 2026 and incorporates itself into the terms of service automatically; the subprocessor list by contrast carries the state of January 2025, and notification about new subprocessors requires the customer to sign up for it explicitly (source: https://www.helpscout.com/company/legal/dpa/, as of 2026-09-09)

## Cost of leaving

Moderate: The useful question is what is missing after the export. The in-app export delivers reporting data as CSV or XLSX and expressly leaves out the contents of the conversations. Anyone who needs the threads themselves fetches them through the Inbox API, and that is developer work. The same limit applies to the read access over MCP, which is expressly read-only. The layer above it is missing too: saved replies, workflows, tags, custom fields, the reporting baseline and the knowledge base with its own styling. The contract adds a short deadline. After cancellation the vendor restores the account on written request for 14 days, after which it is gone. In practice there remains the work of re-pointing every route, from the mailbox addresses through the Twilio number to the help widget on your own site.

## Regulation and data

| Point | Finding | Evidence | As of |
|---|---|---|---|
| Data processing agreement | yes, publicly available, version 2 dated May 2026, part of the contract without further condition — The data processing amendment is openly available online and declares itself part of the terms of service, in its own words requiring no further action by the customer. It covers instruction binding, incident notification, assistance with data subject requests, and return or deletion. The annexes are filled in: both parties are named with addresses, the categories of data are described, and the contact person is chief financial officer Shawna Fisher under a dedicated privacy address. One place stays thin. The annex on technical and organisational measures itemises nothing of its own. It points to the security page, and that page fills half a screen. | evidenced | 2026-09-09 |
| Storage location | United States, with no selectable European region on any plan — The security page names Amazon Web Services as the operator of the environment and leaves the region open. The subprocessor list closes that gap: it holds 20 entries, 18 of them with the United States as country of processing and two with the United Kingdom, namely the vector store Pinecone and the real-time service Pusher. European hosting appears nowhere in the pricing page, the security page, the privacy policy or the data processing amendment, neither as a default nor as a paid option. The location is therefore clearly named and its consequences can be assessed, but it cannot be chosen. | partially evidenced | 2026-09-09 |
| Subprocessors | complete public list with purpose and country, 20 entries, dated January 2025 — Each entry names the company, the purpose and the country of processing, and the list is visible without signing in. For machine learning it names Anthropic, OpenAI and Google, plus Freeplay for AI quality control and Pinecone as a vector store. Two conditions sit in the contract. The vendor announces changes at least ten days in advance, but only to customers who have explicitly signed up to a mailing list for it. And objecting to a new subprocessor is tied to conditions. The date stands out: the list carries the January 2025 version, while the data processing amendment was revised in May 2026. | evidenced | 2026-09-09 |
| Third-country transfer | processing in the United States, based on the EU-US Data Privacy Framework with standard contractual clauses as a fallback; no assignment per recipient — The contract bases transfers first on the EU-US Data Privacy Framework including the UK extension and incorporates the standard contractual clauses under Module 2 as a fallback, with filled annexes and the UK addendum. The official participant list of the US Department of Commerce shows Help Scout on 9 September 2026 under both frameworks with the status active while re-certification is under review, for HR and non-HR data. Two points belong beside that. The Swiss framework is absent from the participant list, although the contract expressly brings Swiss data protection law into its scope while still citing the 1992 act. And for the 20 subprocessors the contract never says which recipient operates on which basis. | partially evidenced | 2026-09-09 |
| Training on customer data | training of the foundation model excluded; for the vendor's own adapter layers customer data stays in use, with no named opt-out — This point rewards close reading, because the vendor answers two different questions right next to each other. On the first it is clear: customer data does not flow back into training OpenAI's foundation model, data from several customers is not blended, and the context handed over does not become permanent training material. On the second a sentence further down reads differently. To evaluate and improve feature quality the vendor uses limited samples of customer data, expressly when tuning its own adapter layers for tone and clarity. No opt-out from that is named anywhere. Anyone wanting AI features removed from the account entirely has to email support according to the same page; there is no switch for it. The chatbot itself is off by default. One divergence in the vendor's own documents stands out beside that: the transparency page names OpenAI alone as its model provider, while the subprocessor list names Anthropic, OpenAI and Google for machine learning. | partially evidenced | 2026-09-09 |
| Retention and deletion | deletion after cancellation promised, restoration for 14 days on written request; no periods stated for backups — The terms of service quantify one period. On cancellation the account and customer data are removed, and the vendor restores them on written request for 14 days after the effective date; after that the account is gone. Through the standard contractual clauses the data processing amendment additionally promises return or deletion at the exporter's choice, including certification. Two figures are missing. None of the documents names a separate period for backups, and none names one for the usage data whose rights the vendor reserves in the master agreement. | partially evidenced | 2026-09-09 |
| Certifications | SOC 2 Type 2 for security and availability, report on request only; no ISO certificate and no C5 attestation named — The vendor names exactly one attestation for itself and states its scope alongside: SOC 2 Type 2 for the security and availability criteria. It releases the report on request through the support address, along with the summary of the latest penetration test by an independent firm. For healthcare it claims ongoing compliance with the US rules and offers a separate agreement for processing health data. What is missing can be counted on one hand: no ISO 27001 certificate, no attestation under the German C5 catalogue, no self-service trust portal and no publicly named audit period. | partially evidenced | 2026-09-09 |
| EU AI Act, Article 50 | labelling of AI towards end customers promised, the regulation itself is named nowhere — The vendor runs a transparency page of its own and promises there what matters for Article 50: the interface is visibly labelled so the end customer knows a machine is answering, and every AI feature carries a marker in the product as text, an icon or both. It names the four AI features, distinguishes a suggestion with human review from a direct answer to the end customer, and describes moderation. Regulation (EU) 2024/1689 appears in none of the documents reviewed, neither on the transparency page nor in the terms of service, the data processing amendment, the privacy policy or the acceptable use policy. The operator can therefore rest the labelling on a written promise, but gets no assessment of the vendor's own duties. | partially evidenced | 2026-09-09 |
| Audit logging | unclear; the only documented view lists the devices currently signed in — Reviewed were the pricing page with its full feature comparison across all four plans, the administrator's guide dated 3 September 2026, the session management page dated 8 September 2026, the security page and the data processing amendment. A log of who changed which setting, which permission or which workflow and when appears at none of these places, on no plan and not as a paid add-on either. What is documented is a per-user view of the devices currently signed in, with the option to end a session; that is a state and not a trail. It therefore stays open in public whether the customer gets a reviewable trail at all, and evidence duties cannot be planned in advance. | not evidenced | 2026-09-09 |

## Cost

- Entry: The free plan covers five users, one inbox, one knowledge base and 100 contacts a month. Standard costs 25 USD, Plus 45 USD and Pro 75 USD per seat per month on annual billing; monthly it is 30, 54 and 90 USD. Standard reaches 25 users, Plus 50, and Pro is open-ended with a minimum of ten seats, so it starts at 9,000 USD a year. The trial for Standard and Plus runs 15 days without a payment method, while Pro goes through a sales conversation. The page quotes prices in US dollars only. (as of 2026-09-09)
- Where it gets expensive: In four places. First the chatbot: AI Answers costs 0.75 USD per resolved case, on every plan and after three free months. A monthly spending cap can be set, and on reaching it the feature switches off for the rest of the month. Second the security features: sign-in through your own directory service and restriction to defined address ranges cost extra on Standard and Plus and are included only on Pro, as is compliance with the US healthcare rules. Third growing past the plan limits: each additional inbox 10 USD, each additional knowledge base 20 USD a month on annual billing. Fourth the voice channels, because telephony runs through Aircall and SMS through your own Twilio number and both are billed there.

## Three routes compared

### The established helpdesk platform next to it

Zendesk is the buy option this decision gets measured against, and Help Scout puts a comparison page against it in its own footer. Larger organisations stay there for three reasons. The attestation stack is broader and names an ISO 27001 certificate alongside SOC 2, European hosting exists, and roles together with an audit log come with the product rather than with research. You pay for that in setup effort and in a price that sits noticeably higher at the same team size. Help Scout addresses teams that do not want to carry that weight. That, rather than a feature list, is where a switch is decided.

### The design that puts AI ahead of people

Intercom's Fin represents the younger design in this catalogue, which makes the resolved case the billing unit and the seat a side matter. Today the difference lies less in the pricing model, because Help Scout uses the same unit at 0.75 USD per resolved case. It lies in the order. At Help Scout the chatbot is off by default and supplements an inbox where people work; at the AI-native vendors the machine answers first and passes on what it cannot handle. Moving there means giving up the work inside the inbox itself, meaning assignment, internal comments and shared drafts. It also means giving up the cheap entry, because the AI-native vendors set their base fee higher.

### Zammad self-hosted, with the AI part built beside it

Nobody writes a shared inbox from scratch. In this class building your own means running it yourself, and the blueprint from this catalogue starts with Zammad on your own environment: inboxes, roles, workflows and knowledge base are ready-made, while hosting location and logging stay in your hands. The AI part that Zammad does not bring is built beside it. LiteLLM keeps the model choice replaceable, Langfuse logs every model call with input and output, n8n connects triggers and rules, Supabase holds the knowledge base for retrieval, Ory handles sign-in and roles. On the order of magnitude, as a stated assumption: 25 to 40 person-days at 1,100 EUR give 27,500 to 44,000 EUR one-off, plus operations and on-call. Help Scout costs roughly 6,500 USD a year for twelve seats on Plus. For small teams the arithmetic rarely works out. It fails on round-the-clock readiness, because a lost delivery is a lost customer request, on the deliverability of outgoing mail, on tenant separation, and on maintenance once the builder leaves the building.

Recommendation by size:

- Solo: The free plan is enough. It delivers a public help site with a contact form, and one person needs no more.
- Mid-market: Buy, Plus. Before signing, clarify which content feeds the vendor's adapter layers, and put your own measure next to the chatbot's resolution rate.
- Enterprise: Buying is usually out, because European hosting and an audit log are missing. Where the department insists, both points belong in the contract with evidence attached.

## Context

- Implements method: [Leading AI Agents as Team Members](https://www.convios.com/en/methods/ai-agents-as-team-members) — AI Answers writes to end customers directly with no human in between, and that is exactly where this method bites: the chatbot needs the same written role, the same measure and the same approver as a new hire.
- Implements method: [Calibrated Evaluation Loop for AI Outputs (Criteria Drift)](https://www.convios.com/en/methods/eval-calibration) — The vendor counts a case as resolved when the customer neither escalates nor keeps searching afterwards, and bills on that basis. This method describes the missing step: such a criterion has to be calibrated against human judgement, otherwise the review measures its own yardstick.
- Implements method: [Good-Better-Best Pricing](https://www.convios.com/en/methods/good-better-best) — Free, Standard, Plus and Pro are a textbook ladder for this method, along with the question it raises: what belongs in the top tier so it keeps the way up open, and what belongs further down because it counts as security. Help Scout puts SSO in the top tier.
- Implements method: [Value Metric Pricing](https://www.convios.com/en/methods/value-metric-pricing) — Help Scout runs two pricing units side by side: the seat, which grows with team size, and the resolved case at 0.75 USD, which grows with request volume. A useful worked example for the question of which unit grows with customer value.
- Alternative: [Zendesk](https://www.convios.com/en/toolbox/zendesk)
- Alternative: [Front](https://www.convios.com/en/toolbox/front)
- Alternative: [Intercom](https://www.convios.com/en/toolbox/intercom)
- Alternative: [Fin](https://www.convios.com/en/toolbox/fin)
- Alternative: [Zammad](https://www.convios.com/en/toolbox/zammad)
- Displaces: A shared support@ mailbox with no visible ownership, Forwarding by hand to whoever is currently reachable, Reply templates in a personal drafts folder, Help pages sent as a PDF attached to the reply

## Evidence

- Plan prices of 25, 45 and 75 USD per seat per month on annual billing, 30, 54 and 90 USD monthly; the free plan covers five users, one inbox, one knowledge base and 100 contacts a month — https://www.helpscout.com/pricing/ (as of 2026-09-09)
- SAML sign-in and restriction to defined address ranges are paid add-ons on Standard and Plus and included only on Pro; Pro requires a minimum of ten seats — https://www.helpscout.com/pricing/ (as of 2026-09-09)
- AI Answers costs 0.75 USD per resolved case after three free months; a case counts as resolved only if the customer neither escalates nor keeps searching nor asks again, and a monthly spending cap switches the feature off on being reached — https://www.helpscout.com/pricing/ (as of 2026-09-09)
- The data processing amendment carries version 2 dated May 2026, declares itself part of the terms of service with no further action by the customer, and holds filled annexes naming both parties, the data categories and a designated contact person — https://www.helpscout.com/company/legal/dpa/ (as of 2026-09-09)
- The annex on technical and organisational measures itemises nothing of its own and points to the security page; the vendor announces subprocessor changes ten days in advance, but only to customers who have explicitly signed up for it — https://www.helpscout.com/company/legal/dpa/ (as of 2026-09-09)
- The public subprocessor list carries the state of January 2025 and holds 20 entries with purpose and country, 18 of them in the United States and two in the United Kingdom; for machine learning it names Anthropic, OpenAI and Google — https://www.helpscout.com/company/legal/sub-processors/ (as of 2026-09-09)
- The transparency page names OpenAI alone as the provider of the foundation models used, excludes training the foundation model on customer data, and at the same time states that the vendor uses limited samples of customer data to evaluate and improve feature quality, for example when tuning its own adapter layers — https://www.helpscout.com/company/legal/ai-transparency/ (as of 2026-09-09)
- The transparency page promises that the interface is visibly labelled and the end customer knows a machine is answering; the chatbot is off by default, and for the complete removal of AI features the vendor points to a support request — https://www.helpscout.com/company/legal/ai-transparency/ (as of 2026-09-09)
- The contracting party is Help Scout PBC, a Delaware public benefit corporation; Delaware law applies with venue in Wilmington and an arbitration clause under the JAMS rules, and after cancellation the account is restored on written request for 14 days — https://www.helpscout.com/company/legal/terms-of-service/ (as of 2026-09-09)
- The security page names SOC 2 Type 2 for security and availability, releases the report and the penetration test summary on request, and names Amazon Web Services as the operator of the environment; no ISO 27001 certificate and no C5 attestation is named — https://www.helpscout.com/company/legal/security/ (as of 2026-09-09)
- The official participant list of the US Department of Commerce shows Help Scout, Nashville, Tennessee, under the EU-US Data Privacy Framework and the UK extension with the status active while re-certification is under review, for HR and non-HR data; the Swiss framework is not listed — https://www.dataprivacyframework.gov/list (as of 2026-09-09)
- The in-app export delivers reporting data as CSV or XLSX and expressly excludes the contents of the conversations; all remaining data can be obtained only through the APIs — https://docs.helpscout.com/article/466-data-export-options (as of 2026-09-09)
- The MCP endpoint at mcp.helpscout.net is read-only and can neither create nor send, edit or delete; it is available from Standard, with reports from Plus — https://docs.helpscout.com/article/1779-connect-your-ai-agent-with-help-scout-to-search-conversations-and-pull-reports (as of 2026-09-09)
- Session management shows the devices currently signed in per user and allows a session to be ended; the public documentation describes no log of changed settings, permissions or workflows — https://docs.helpscout.com/article/910-session-managament (as of 2026-09-09)
- By the vendor's own account founded in 2011, working fully remotely from more than 115 cities, more than 12,000 customer-facing teams served and more than 950 million customer conversations handled; no measurement method is stated — https://www.helpscout.com/about/ (as of 2026-09-09)
- The public incident archive reaches back to 9 July 2025 and lists 33 entries for the period 1 January 2026 to 31 August 2026, among them one major on 14 July 2026 and one critical on 20 April 2026 — https://status.helpscout.com/history (as of 2026-09-09)
- Dated product notes at a monthly cadence, ten entries between 18 May 2026 and 11 August 2026, most recently a customer portal for several contacts of one company on 11 August 2026 — https://updates.helpscout.com/ (as of 2026-09-09)