# Zammad

> Brings requests from email, web forms, chat and messengers into one case system, so it stays traceable who promised what and when, instead of cases disappearing into a shared mailbox.

- Vendor: Zammad GmbH
- Canonical URL: https://www.convios.com/en/toolbox/zammad
- Language version: https://www.convios.com/de/werkzeugkasten/zammad
- Area: Service & support · Cluster: self-hosted support
- Role: Off-the-shelf product · Origin: Established, AI retrofitted
- As of: 2026-07-30 · Reviewed: 2026-07-30 · Author: Dr. Oliver Gausmann, Convios GmbH
- Toolbox: https://www.convios.com/en/toolbox — Markdown: https://www.convios.com/en/toolbox.md

## Verdict

Prevents falling behind: A ticketing system creates no edge, it keeps you from falling behind. Without one, cases get lost and nobody can prove what was promised. With one, a company is still not distinguishable, because competitors have one too. What sets this tool apart from others in its class is not the feature list but the exit edge: source code under AGPLv3, data in a database you own, operation in your own data centre if you want it. Working with it does not buy dependency along the way.

## Suitability by company size

- Solo: suitable with caveats — Hosted, the Starter plan begins at 7 EUR per agent per month, but it stops at five agents and offers neither chat nor knowledge base. Self-hosting does not pay off for a single person, because updates, backups and recovery cost working hours that do not exist on the side.
- Mid-market: suitable — This is the tool's home ground. Up to 35 agents, Professional costs 16 EUR per agent per month, and anyone who runs infrastructure anyway pays nothing for the software itself. Both routes are predictable, and moving between them is described in the vendor's own documentation.
- Enterprise: suitable with caveats — Unlimited agents only start with the Plus plan at 25 EUR. Procurement will find public evidence missing: no named subprocessor list, no certificate held by the vendor itself that we could locate, and audit log entries are removed after twelve months with no way to configure that period.

## Vendor staying power

Established: Twelve years in market, its own legal entity with a register entry, a release cadence running through June 2026. The capital side is not substantiated: revenue, profit and any investors were not found in this review. Ownership of the source code sits with a foundation independent of the company, which softens the vendor-viability question for the software itself, though not for hosting and support.

- Years in market: founded in 2014 by Martin Edenhofer, version 7.0 in 2026 (source: https://zammad.com/en/company/about-us, as of 2026-07-30)
- Legal entity: Zammad GmbH, Marienstraße 18, 10117 Berlin, Charlottenburg local court HRB 163946 B, managing director Martin Edenhofer, VAT ID DE298516802 (source: https://zammad.com/en/company/imprint, as of 2026-07-30)
- Size and reach: 31 employees, over 65,000 users, 1,500 paying customers (vendor claim; the customer figure dates from December 2022) (source: https://zammad.com/en/company/about-us, as of 2026-07-30)
- Release cadence: 7.0 on 4 March 2026, 7.1 on 17 June 2026, security release 7.1.1 on 25 June 2026 (source: https://zammad.com/en/product/releases, as of 2026-07-30)
- Ownership of the source code: AGPLv3, source code owned by the Zammad Foundation, independent of Zammad GmbH according to the documentation (source: https://docs.zammad.org/en/pre-release/about/zammad.html, as of 2026-07-30)
- Public development: around 5,800 stars and roughly 19,600 commits on the main branch on GitHub (source: https://github.com/zammad/zammad, as of 2026-07-30)
- Funding and results: not substantiated, no public figure found

## Cost of leaving

Low: The source code is AGPLv3, the data sits in a database you control, and the vendor's documentation describes moving to another server as a backup and restore. For leaving the hosted edition, that same guide assumes the vendor hands you a dump; how to request it is not stated there. The cost of leaving is operational work, not contractual pain. You can keep using the tool without paying the vendor, and that is the real value here.

## Regulation and data

| Point | Finding | Evidence | As of |
|---|---|---|---|
| Data processing agreement | on request, including technical and organisational measures — The agreement is not offered for download but requested from support by email. The vendor says it can be adapted. That means the wording cannot be reviewed publicly before signing. | partially evidenced | 2026-07-30 |
| Storage location | hosted plans run in German data centres only; self-hosted, you choose the location yourself — The vendor names the country but neither the data centre operator nor the sites. Self-hosted, the question does not arise, because the database runs on your own infrastructure. | evidenced | 2026-07-30 |
| Subprocessors | unclear, no public list found — We found no public subprocessor list. We checked the pricing page, the privacy policy, the support knowledge base and the admin documentation. The privacy policy only names services used on the vendor's own website, namely Matomo, Moosend and Vimeo, not the processors behind the hosted service. | partially evidenced | 2026-07-30 |
| Third-country transfer | none in the hosted service according to the vendor; for AI it depends on the model you pick — The ticketing system itself stays in Germany. Third-country processing only enters through your own choice of language model: connecting OpenAI or Anthropic creates it yourself. Zammad AI is operated in the EU according to the admin documentation, and Ollama runs on your own hardware. | evidenced | 2026-07-30 |
| Training on customer data | ruled out for Zammad AI; for third-party models it is a matter for that provider — The admin documentation states for Zammad AI that requests containing sensitive information are not used for training. Connect your own model and the terms of that provider apply instead of this commitment. | evidenced | 2026-07-30 |
| Retention and deletion | audit log fixed at twelve months; users and tickets are removed through a dedicated deletion feature — The system removes audit log entries after twelve months, and the documentation states this period is not configurable. For personal data there is a deletion feature with tasks that can also run on a schedule. Deleting a user removes their tickets along with them, and the two cannot be separated. | evidenced | 2026-07-30 |
| Certifications | ISO 27001 for the hosted Professional and Plus plans — The knowledge base says the plans are ISO 27001 certified. Whether the certificate belongs to Zammad GmbH or to the data centre operator does not follow from the source. A certificate held by the infrastructure provider is not the same as one held by the vendor. For the Starter plan and for self-hosting, the statement does not apply at all. | partially evidenced | 2026-07-30 |
| EU AI Act, Article 50 | raised by the vendor, no public evidence — In the press release for version 7.0 the vendor points to an architecture with a human making the final decision and to traceability. That is a self-declaration. We found no statement on the Article 50 transparency duties that apply from August 2026, and no risk classification of the features. | partially evidenced | 2026-07-30 |
| Audit logging | audit log built into the product, read-only, behind its own permission — The log records actions requiring admin permissions, meaning configuration changes, account changes and switching into other users' sessions. Everyday ticket changes are not there but in each ticket's own history. The documentation does not say which plans include the feature. | evidenced | 2026-07-30 |

## Cost

- Entry: Two separate routes. Hosted, Starter costs 7 EUR per agent per month on annual billing (9 EUR monthly, at most five agents), Professional 16 EUR (18 EUR monthly, at most 35 agents), Plus 25 EUR (27 EUR monthly, unlimited). Self-hosted there are no licence fees, and the vendor explicitly confirms that anyone may run Zammad on their own servers at no cost. The trial runs 30 days on the Professional plan. All prices exclude VAT. (as of 2026-07-30)
- Where it gets expensive: In three places. First, self-hosted support: Business costs 2,999 EUR a year for 15 service requests, Enterprise 5,999 EUR for 45, Corporation 9,999 EUR for 95. Exhaust the quota and you pay on top, and the notice period is at least 90 calendar days before the contract year ends. Second, AI: 0.03 EUR per call sounds small but falls due for every summary, suggestion and classification, so it scales with request volume, not headcount. Third, running it yourself: the licence you saved reappears as servers, updates, backups and on-call time. If you are not doing that work anyway, you save nothing, you only move the bill.

## Three routes compared

### Hosted helpdesk platform from the big vendors

Zendesk and its peers deliver more channels, more reporting and more ready-made integrations. You pay for it with the seat price, with features locked behind higher tiers, and with data and operations sitting at the vendor. Leaving after three years means running a migration, not a move. For organisations without an operations team and without particular data-residency requirements, it is still the faster route.

### AI agent that resolves requests instead of routing them

A newer class of vendors bills per resolved case rather than per seat and promises to answer most requests without a human. That shifts the cost curve from headcount to consumption and turns answer quality into a contractual matter. As the only system it is not enough, because every unresolved case still needs a case system to land in. The realistic move is combining the two, not replacing one with the other.

### Adapt rather than build from scratch

Building a ticketing system from scratch is wasted time; the category is far too mature for that. With AGPLv3 software, building your own means something else: your own hosting, your own extensions, your own links into the line-of-business systems, with nobody able to switch off access. The price is operational responsibility, meaning updates, backups and recovery, plus the AGPLv3 obligations once you make the service available to third parties.

Recommendation by size:

- Solo: Start hosted, do not run it yourself.
- Mid-market: Self-host if you have an operations team, otherwise buy it hosted.
- Enterprise: Self-host and demand the missing evidence in writing before signing.

## Context

- Implements method: [Service Blueprinting](https://www.convios.com/en/methods/service-blueprinting) — A blueprint needs the actual sequence behind the line of visibility, and a case system with a full history supplies that sequence from live operation rather than from a workshop.
- Implements method: [Regulatory Density Test](https://www.convios.com/en/methods/regulatory-density-test) — The test gets concrete where obligations concern the storage location of personal customer data, and openly licensed source with your own database is the answer where those obligations really are tighter.
- Alternative: [Zendesk](https://www.convios.com/en/toolbox/zendesk)
- Displaces: Shared support mailbox, Request tracking in spreadsheets, Requests shouted into chat groups

## Evidence

- Plan prices, agent limits, support packages, price per AI call, trial period, notice period — https://zammad.com/en/pricing (as of 2026-07-30)
- Storage exclusively in Germany, ISO 27001 statement for Professional and Plus, reference to the data processing agreement — https://support.zammad.com/help/en-us/2-regular-subscriptions-hosted/108-where-is-my-data-and-how-is-it-protected (as of 2026-07-30)
- Self-hosting without licence fees, support contract as an optional add-on — https://support.zammad.com/help/en-us/51-getting-started/8-why-is-there-a-paid-subscription-for-self-hosting-i-thought-zammad-was-free (as of 2026-07-30)
- Audit log is read-only, entries removed after twelve months, period not configurable — https://admin-docs.zammad.org/en/pre-release/system/audit-logs.html (as of 2026-07-30)
- Choice of language models, Zammad AI operated in the EU, sensitive requests not used for training — https://admin-docs.zammad.org/en/latest/ai/provider.html (as of 2026-07-30)
- Moving to another server via backup and restore, including the note on leaving the hosted edition — https://docs.zammad.org/en/latest/appendix/backup-and-restore/migrate-hosts.html (as of 2026-07-30)
- AGPLv3 licence, source code owned by the Zammad Foundation, independent of Zammad GmbH — https://docs.zammad.org/en/pre-release/about/zammad.html (as of 2026-07-30)
- Legal entity, register court, register number, managing director — https://zammad.com/en/company/imprint (as of 2026-07-30)
- Founding year, headcount, user and customer numbers, version history — https://zammad.com/en/company/about-us (as of 2026-07-30)
- Self-declaration on the EU AI Act and the role of the human in the decision — https://zammad.com/en/company/press/zammad-introduces-ai-features-with-free-choice-of-large-language-model (as of 2026-07-30)