Zammad
Zammad GmbH ·zammad.com· As of: 2026-07-30
Our verdict
A ticketing system creates no advantage, it prevents relapse. Without one, cases get lost and nobody can prove what was promised. With one, a company is still not distinguishable, because competitors have one too. What sets this tool apart from others in its class is not the feature list but the exit edge: source code under AGPLv3, data in a database you own, operation in your own data centre if you want it. Working with it does not buy dependency along the way.
Who it fits
Solo
suitable with caveats
Hosted, the Starter plan carries from 7 EUR per agent per month, but it stops at five agents and offers neither chat nor knowledge base. Self-hosting does not pay off for a single person, because updates, backups and recovery cost working hours that do not exist on the side.
Mid-market
suitable
This is the tool's home ground. Up to 35 agents, Professional costs 16 EUR per agent per month, and anyone who runs infrastructure anyway pays nothing for the software itself. Both routes are predictable, and moving between them is described in the vendor's own documentation.
Enterprise
suitable with caveats
Unlimited agents only start with the Plus plan at 25 EUR. Procurement will find public evidence missing: no named subprocessor list, no certificate held by the vendor itself that we could locate, and audit log entries are removed after twelve months with no way to configure that period.
Buy, switch or build
Off-the-shelf
Hosted helpdesk platform from the big vendors
Zendesk and its peers deliver more channels, more reporting and more ready-made integrations. You pay for it with the seat price, with features locked behind higher tiers, and with data and operations sitting at the vendor. Leaving after three years means running a migration, not a move. For organisations without an operations team and without particular data-residency requirements, it is still the faster route.
AI-native
AI agent that resolves requests instead of routing them
A newer class of vendors bills per resolved case rather than per seat and promises to answer most requests without a human. That shifts the cost curve from headcount to consumption and turns answer quality into a contractual matter. As the only system it does not hold, because every unresolved case still needs a case system to land in. The realistic move is combining the two, not replacing one with the other.
Build it yourself
Adapt rather than build from scratch
Building a ticketing system from scratch is wasted time; the category is far too mature for that. With AGPLv3 software, building your own means something else: your own hosting, your own extensions, your own links into the line-of-business systems, with nobody able to switch off access. The price is operational responsibility, meaning updates, backups and recovery, plus the AGPLv3 obligations once you make the service available to third parties.
Our advice
- Solo: Start hosted, do not run it yourself.
- Mid-market: Self-host if you have an operations team, otherwise buy it hosted.
- Enterprise: Self-host and demand the missing evidence in writing before signing.
Who is behind it
Staying power: Established
Twelve years in market, its own legal entity with a register entry, a release cadence running through June 2026. The capital side is not substantiated: revenue, profit and any investors were not found in this review. Ownership of the source code sits with a foundation independent of the company, which softens the vendor-viability question for the software itself, though not for hosting and support.
- Years in market: founded in 2014 by Martin Edenhofer, version 7.0 in 2026 · Source · As of 2026-07-30
- Legal entity: Zammad GmbH, Marienstraße 18, 10117 Berlin, Charlottenburg local court HRB 163946 B, managing director Martin Edenhofer, VAT ID DE298516802 · Source · As of 2026-07-30
- Size and reach: 31 employees, over 65,000 users, 1,500 paying customers (vendor claim; the customer figure dates from December 2022) · Source · As of 2026-07-30
- Release cadence: 7.0 on 4 March 2026, 7.1 on 17 June 2026, security release 7.1.1 on 25 June 2026 · Source · As of 2026-07-30
- Ownership of the source code: AGPLv3, source code owned by the Zammad Foundation, independent of Zammad GmbH according to the documentation · Source · As of 2026-07-30
- Public development: around 5,800 stars and roughly 19,600 commits on the main branch on GitHub · Source · As of 2026-07-30
- Funding and results: not substantiated, no public figure found · no source given · As of 2026-07-30
Cost of leaving: Low
The source code is AGPLv3, the data sits in a database you control, and the vendor's documentation describes moving to another server as a backup and restore. For leaving the hosted edition, that same guide assumes the vendor hands you a dump; how to request it is not stated there. The cost of leaving is operational work, not contractual pain. You can keep using the tool without paying the vendor, and that is the real value here.
Regulation and data
| Data processing agreement | on request, including technical and organisational measuresThe agreement is not offered for download but requested from support by email. The vendor says it can be adapted. That means the wording cannot be reviewed publicly before signing.Source · As of 2026-07-30 |
|---|---|
| Storage location | hosted plans run in German data centres only; self-hosted, you choose the location yourselfThe vendor names the country but neither the data centre operator nor the sites. Self-hosted, the question does not arise, because the database runs on your own infrastructure.Source · As of 2026-07-30 |
| Subprocessors | unclear, no public list foundWe found no public subprocessor list. We checked the pricing page, the privacy policy, the support knowledge base and the admin documentation. The privacy policy only names services used on the vendor's own website, namely Matomo, Moosend and Vimeo, not the processors behind the hosted service.Source · As of 2026-07-30 |
| Third-country transfer | none in the hosted service according to the vendor; for AI it depends on the model you pickThe ticketing system itself stays in Germany. Third-country processing only enters through your own choice of language model: connecting OpenAI or Anthropic creates it yourself. Zammad AI is operated in the EU according to the admin documentation, and Ollama runs on your own hardware.Source · As of 2026-07-30 |
| Training on customer data | ruled out for Zammad AI; for third-party models it is a matter for that providerThe admin documentation states for Zammad AI that requests containing sensitive information are not used for training. Connect your own model and the terms of that provider apply instead of this commitment.Source · As of 2026-07-30 |
| Retention and deletion | audit log fixed at twelve months; users and tickets are removed through a dedicated deletion featureThe system removes audit log entries after twelve months, and the documentation states this period is not configurable. For personal data there is a deletion feature with tasks that can also run on a schedule. Deleting a user removes their tickets along with them, and the two cannot be separated.Source · As of 2026-07-30 |
| Certifications | ISO 27001 for the hosted Professional and Plus plansThe knowledge base says the plans are ISO 27001 certified. Whether the certificate belongs to Zammad GmbH or to the data centre operator does not follow from the source. A certificate held by the infrastructure provider is not the same as one held by the vendor. For the Starter plan and for self-hosting, the statement does not apply at all.Source · As of 2026-07-30 |
| EU AI Act, Article 50 | raised by the vendor, no public evidenceIn the press release for version 7.0 the vendor points to an architecture with a human making the final decision and to traceability. That is a self-declaration. We found no statement on the Article 50 transparency duties that apply from August 2026, and no risk classification of the features.Source · As of 2026-07-30 |
| Audit logging | audit log built into the product, read-only, behind its own permissionThe log records actions requiring admin permissions, meaning configuration changes, account changes and switching into other users' sessions. Everyday ticket changes are not there but in each ticket's own history. The documentation does not say which plans include the feature.Source · As of 2026-07-30 |
What it really costs
Entry price
Two separate routes. Hosted, Starter costs 7 EUR per agent per month on annual billing (9 EUR monthly, at most five agents), Professional 16 EUR (18 EUR monthly, at most 35 agents), Plus 25 EUR (27 EUR monthly, unlimited). Self-hosted there are no licence fees, and the vendor explicitly confirms that anyone may run Zammad on their own servers at no cost. The trial runs 30 days on the Professional plan. All prices exclude VAT.
Source · As of2026-07-30
What gets expensive
In three places. First, self-hosted support: Business costs 2,999 EUR a year for 15 service requests, Enterprise 5,999 EUR for 45, Corporation 9,999 EUR for 95. Exhaust the quota and you pay on top, and the notice period is at least 90 calendar days before the contract year ends. Second, AI: 0.03 EUR per call sounds small but falls due for every summary, suggestion and classification, so it scales with request volume, not headcount. Third, running it yourself: the licence you saved reappears as servers, updates, backups and on-call time. If you are not doing that work anyway, you save nothing, you only move the bill.
What it displaces
- Shared support mailbox
- Request tracking in spreadsheets
- Requests shouted into chat groups
Interfaces
- REST API
- Webhooks
- Backup and restore dump covering database and files
- Language models through Zammad AI, OpenAI, Anthropic, Azure AI, Mistral AI, Ollama and OpenAI-compatible providers
At Convios: Not used by us
Not used in our own operation. Every statement here comes from the vendor's pricing page, knowledge base and admin documentation, not from first-hand experience.
Matching methods
Alternatives
Evidence
- 1.Plan prices, agent limits, support packages, price per AI call, trial period, notice period · As of 2026-07-30
- 2.Storage exclusively in Germany, ISO 27001 statement for Professional and Plus, reference to the data processing agreement · As of 2026-07-30
- 3.Self-hosting without licence fees, support contract as an optional add-on · As of 2026-07-30
- 4.Audit log is read-only, entries removed after twelve months, period not configurable · As of 2026-07-30
- 5.Choice of language models, Zammad AI operated in the EU, sensitive requests not used for training · As of 2026-07-30
- 6.Moving to another server via backup and restore, including the note on leaving the hosted edition · As of 2026-07-30
- 7.AGPLv3 licence, source code owned by the Zammad Foundation, independent of Zammad GmbH · As of 2026-07-30
- 8.Legal entity, register court, register number, managing director · As of 2026-07-30
- 9.Founding year, headcount, user and customer numbers, version history · As of 2026-07-30
- 10.Self-declaration on the EU AI Act and the role of the human in the decision · As of 2026-07-30
Last reviewed: 2026-07-30byDr. Oliver Gausmann, Convios GmbH
Details out of date? Let us know.