Prevents falling behindOff-the-shelf productEstablished, AI retrofitted

Zendesk

Zendesk, Inc. ·www.zendesk.de· As of: 2026-07-30

Collects customer requests from email, chat, phone and social channels into one ticket store with ownership, deadlines and history, so that no request disappears in a shared mailbox.

Work through this tool with an AI

ClaudeChatGPTPerplexity

Our verdict

A helpdesk creates no edge, because every competitor can buy the same one. Without one you lose commitments, deadlines and the history of a case, and you fall behind a standard customers already assume. The difference comes from what happens to the case data afterwards, not from the ticket system itself. That is precisely why Zendesk is the buy option against which every switch or build decision gets measured.

Evidence:As of 2026-07-30Plan prices of 19, 55 and 115 EUR per seat per month, the Copilot, workforce engagement and contact centre add-ons, and outcome-based billing of automated resolutionsOpen sourceAs of 2026-07-30EU hosting depends on the Data Center Location add-on, which is free of charge but only applies from Suite Professional upwards and is not activated automaticallyOpen sourceAs of 2026-07-30Without that add-on the vendor makes no hosting location commitment and moves account data between regions without noticeOpen sourceAs of 2026-07-30Even with a region activated, named exceptions stay in the United States, among them voice text data, chat email reports and campaign dataOpen sourceAs of 2026-07-30Access logs, customer-managed encryption keys and masking sit in the paid add-on from Suite Enterprise upwards, with no public priceOpen sourceAs of 2026-07-30Data processing is part of the contract, standard contractual clauses Module 2 are incorporated, and the vendor self-certifies under the EU-US Data Privacy FrameworkOpen sourceAs of 2026-07-30Sub-processors are named in full with purpose and location, and new ones are announced 30 days in advanceOpen sourceAs of 2026-07-30Bulk export is not enabled by default, must be requested from support, is missing on entry plans, and the CSV export omits comments and descriptionsOpen sourceAs of 2026-07-30External language model providers do not train on customer data, while the vendor's own models are trained on sanitised service dataOpen sourceAs of 2026-07-30Deletion starts 90 days after cancellation, production data after 40 to 120 days depending on the service, backups up to 130 daysOpen sourceAs of 2026-07-30Acquisition by a consortium led by Hellman & Friedman and Permira for about 10.2 billion dollars, completed on 22 November 2022Open sourceAs of 2026-07-30Certifications under ISO 27001:2022, 27017, 27018 and 27701 plus SOC 2 Type II on requestOpen source

Who it fits

Solo

suitable with caveats

Entry through Support Team at 19 EUR per seat per month is affordable. But someone working alone rarely needs more than a tidy mailbox, and documented EU storage only starts two plans higher up.

Mid-market

suitable

This is where the tool fits best. Multiple channels, escalation rules and reporting are covered from Suite Team upwards, and rollout needs no dedicated project team. The bill stays manageable as long as the seat count is stable.

Enterprise

suitable

Roles, tenants, certifications and audit logging exist, but some of them sit behind Enterprise and behind a paid add-on with no public price. Anyone who needs evidence negotiates for it item by item instead of simply booking it.

Buy, switch or build

Off-the-shelf

The established off-the-shelf helpdesk

You buy a finished category with channels, rules, reporting and a market of extensions. Rollout takes days rather than months, and nobody has to reinvent the basics. You pay with seat prices that grow with the team, and with a data setup whose location and logging depend on plan tiers and add-ons rather than on the contract.

AI-native

A helpdesk that optimises for resolution instead of tickets

The younger design flips the target metric: what counts is not the well-managed ticket but the request that never reaches a human. That cuts the number of seats needed and shifts cost into consumption. The price is dependence on the quality of the knowledge base and a young vendor market where staying power is rarely substantiated. Zendesk itself is moving the same way with its outcome-based billing.

Build it yourself

Your own case register on your own database

A full helpdesk is not worth building. Building makes sense only where the case originates in your own product and the case data belongs to that product, for instance when every ticket hangs off a device, a contract or a record. Then you build the register yourself and buy channels and interface around it. Doing this without that reason means spending two years rebuilding features available at 55 EUR per seat.

Our advice

  • Solo: Buy, smallest plan, no add-ons. As long as no EU commitment is needed, Support Team is enough.
  • Mid-market: Buy. Before signing, get EU hosting activated in writing and ask for the price per automated resolution.
  • Enterprise: Buy, but write hosting location, audit logging and the AI regulation transparency duties into the contract instead of booking them.

Who is behind it

Staying power: Established

The vendor has been in market since 2007 and has been owned by a consortium of financial investors since late 2022. That secures capital but shifts governance towards returns, which shows up in how pricing is set.

  • Year founded: 2007, headquartered in San FranciscoAs of 2026-07-30zendesk.de/aboutOpen source · As of 2026-07-30
  • Ownership: acquired by a consortium led by Hellman & Friedman and Permira together with ADIA and GIC, roughly USD 10.2 billion, completed on 22 November 2022; privately held since thenAs of 2026-07-30Acquisition by a consortium led by Hellman & Friedman and Permira for about 10.2 billion dollars, completed on 22 November 2022Open source · As of 2026-07-30
  • Certification: ISO 27001:2022, ISO 27017:2015, ISO 27018:2019, ISO 27701:2019, SOC 2 Type II on request, PCI DSS, FedRAMP LI-SaaS, CSA STAR AI Level 1 and 2As of 2026-07-30Certifications under ISO 27001:2022, 27017, 27018 and 27701 plus SOC 2 Type II on requestOpen source · As of 2026-07-30
  • Handling of sub-processors: complete public list, new sub-processors announced at least 30 days in advance, right to object in writing; version effective 16 July 2026 for new customers and 15 August 2026 for existing onesAs of 2026-07-30Sub-processors are named in full with purpose and location, and new ones are announced 30 days in advanceOpen source · As of 2026-07-30
  • Contracting entity: Zendesk, Inc., a Delaware corporation, 181 Fremont St., San Francisco; the master subscription agreement names no separate EU contracting entityAs of 2026-07-30zendesk.de/…/master-subscription-agreementOpen source · As of 2026-07-30

Cost of leaving: Moderate

The data belongs to the customer and can be pulled through the REST API on every plan. Convenient it is not: bulk export to JSON, CSV or XML is not enabled by default according to the vendor, the account owner has to request it from support, the export tool is missing on entry plans, the CSV export omits ticket comments and descriptions, and AI agent tickets cannot be exported at all. After the term ends, 30 days remain for the export.

Regulation and data

How to read the traffic lightHow to read the traffic lightThe traffic light rates how well a point is evidenced, not how good the tool is. It draws only on the value, note and source held in the profile. Where a statement is missing, it rates the absence, not a guess. A well-reasoned "unclear" on a point that matters little for this tool is yellow. A missing source on a point that decides whether you can use it at all is red.documented, no condition attacheddocumented, tied to a conditiondocumented, but unfavourableopen on a point that decides usability
Data processing agreementScale for this point: Data processing agreementdocumented, no condition attached: Auftragsverarbeitungsvertrag öffentlich abrufbar und ohne weitere Bedingung Bestandteil des Vertrags; oder er entfällt nachvollziehbar begründet, weil kein Anbieter Kundendaten verarbeitet.documented, tied to a condition: Vertrag existiert, ist aber an einen Tarif gebunden, nur nach Anfrage einsehbar oder allein in den Nutzungsbedingungen geregelt statt als eigenes Dokument.documented, but unfavourable: Kein Auftragsverarbeitungsvertrag im üblichen Sinn: entweder weil der Anbieter für das Kerngeschäft eigenständig Verantwortlicher ist und stattdessen eine andere Konstruktion gilt, oder weil öffentlich offen bleibt, ob überhaupt einer angeboten wird.open on a point that decides usability: Weder ein Vertrag noch ein dokumentierter Weg zu einem Vertrag; der Einkauf hätte nichts, worauf er sich stützen kann.documented, no condition attachedyes, as part of the contractAs of 2026-07-30Data processing is part of the contract, standard contractual clauses Module 2 are incorporated, and the vendor self-certifies under the EU-US Data Privacy FrameworkOpen sourceThe data processing agreement is, per the vendor, part of the contract and does not need to be negotiated separately. Signing it electronically is possible in addition.As of 2026-07-30
Storage locationScale for this point: Storage locationdocumented, no condition attached: EU-Speicherort ohne Zusatzkosten und ohne Tarifbindung, oder der Ort ist vollständig selbst bestimmbar, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: EU-Speicherort möglich, aber an einen Tarif, einen gesondert zu aktivierenden Zusatz oder einen Umzug in eine getrennte Umgebung gebunden; oder die EU-Region ist nicht die Voreinstellung.documented, but unfavourable: Kein EU-Speicherort, der Ort ist aber eindeutig benannt, sodass die Folgen bewertbar sind.open on a point that decides usability: Der Speicherort ist öffentlich nicht benannt oder vom Kunden nicht steuerbar, sodass sich die Verarbeitung nicht verorten lässt.documented, tied to a conditionEU data location only with the separately activated Data Center Location add-on, available from Suite Professional upwardsAs of 2026-07-30EU hosting depends on the Data Center Location add-on, which is free of charge but only applies from Suite Professional upwards and is not activated automaticallyOpen sourceThis is the instructive part. The vendor states explicitly that it only makes hosting location commitments to customers who have this add-on, and that it otherwise moves account data between regions without notice. The add-on carries no charge per the vendor, but it is not active automatically and has to be requested from the account representative or support. Selectable regions include the European Economic Area, the United Kingdom, the United States, Japan and Australia. Even with the add-on, named exceptions stay in the United States, among them voice text data, chat email reports and campaign data.As of 2026-07-30
SubprocessorsScale for this point: Subprocessorsdocumented, no condition attached: Vollständige öffentliche Liste der Unterauftragnehmer mit Zweck und Land; oder es gibt keine, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Liste existiert und ist benannt, aber nur nach Anfrage oder nach Zugang zu einem Vertrauensportal einsehbar, oder sie nennt Zweck und Land nicht vollständig.documented, but unfavourable: Keine geführte Liste; namentlich stehen nur einzelne Dienste in der Datenschutzerklärung, überwiegend solche der eigenen Website.open on a point that decides usability: Weder eine Liste noch eine Nennung der Verarbeiter des Produkts, und kein dokumentierter Weg, sie zu erfahren.documented, no condition attachednamed publicly and in fullAs of 2026-07-30Sub-processors are named in full with purpose and location, and new ones are announced 30 days in advanceOpen sourceThe list names purpose and location, including Amazon Web Services as infrastructure in the United States, Ireland, Germany, the United Kingdom, Japan and Australia, plus Cloudflare, Twilio, Snowflake, Datadog and MongoDB. For generative features it names OpenAI, Microsoft, Google, Groq, ElevenLabs and Fireworks.As of 2026-07-30
Third-country transferScale for this point: Third-country transferdocumented, no condition attached: Keine Übermittlung in ein Drittland, oder die Übermittlung findet statt und die Grundlage ist benannt und im Vertrag verankert, etwa Standardvertragsklauseln, Angemessenheitsbeschluss oder EU-US-Datenschutzrahmen.documented, tied to a condition: Übermittlung findet statt, eine Grundlage ist genannt, aber ohne Zuordnung, welcher Empfänger auf welcher Grundlage arbeitet.documented, but unfavourable: Übermittlung findet statt und die eigenen Unterlagen widersprechen sich, oder die genannte Grundlage bezieht sich erkennbar nur auf einen Randbereich wie die Marketing-Website.open on a point that decides usability: Übermittlung findet erkennbar statt und eine Grundlage wird nirgends genannt.documented, no condition attachedprocessing in the United States, based on standard contractual clauses and self-certification under the EU-US Data Privacy FrameworkAs of 2026-07-30Data processing is part of the contract, standard contractual clauses Module 2 are incorporated, and the vendor self-certifies under the EU-US Data Privacy FrameworkOpen sourceThe agreement incorporates the Commission's standard contractual clauses under Module 2 and adds the UK addendum for the United Kingdom. The vendor commits to maintaining its self-certification.As of 2026-07-30
Training on customer dataScale for this point: Training on customer datadocumented, no condition attached: Vertraglich oder in der Datenschutzerklärung ausdrücklich ausgeschlossen, mit Erstreckung auf die eingesetzten Modellanbieter; oder es gibt keine Datenübertragung an einen Anbieter.documented, tied to a condition: Ausschluss ab einem bestimmten Tarif, oder die Zusage steht nur auf einer Dokumentationsseite statt im Vertrag, oder die Frage stellt sich für das Werkzeug sachlich kaum und der Anbieter schweigt dazu.documented, but unfavourable: Nutzung ist die Voreinstellung und nur ein Widerspruch beendet sie; oder der Anbieter trainiert eigene Modelle auf bereinigten Kundendaten.open on a point that decides usability: Keine Aussage, obwohl das Werkzeug KI-Funktionen auf Kundeninhalten betreibt.documented, but unfavourableexternal model providers do not train on the data; the vendor's own models are trained on sanitised service dataAs of 2026-07-30External language model providers do not train on customer data, while the vendor's own models are trained on sanitised service dataOpen sourceBoth hold at once and are often confused. The vendor commits that external language model providers do not use customer data for their training, and points to zero retention endpoints. For its own models, which may also serve other customers, it instead describes sanitisation: fields carrying identifiers such as name and email address are excluded, and free text is machine-stripped of identifying markers. A publicly documented opt-out did not surface in this review.As of 2026-07-30
Retention and deletionScale for this point: Retention and deletiondocumented, no condition attached: Löschfristen nach Vertragsende beziffert und die Löschung oder Rückgabe zugesagt; oder die Fristen bestimmt der Betreiber selbst, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Löschung ist zugesagt, die Fristen sind aber nur teilweise beziffert, oder Sicherungskopien sind ausdrücklich ausgenommen.documented, but unfavourable: Nur der Grundsatz der Erforderlichkeit ohne jede Frist nach Vertragsende, oder Fristen sind allein für Randbereiche wie Website-Protokolle genannt.open on a point that decides usability: Keine Aussage zu Aufbewahrung und Löschung.documented, no condition attacheddeletion starts 90 days after termination, production data after 40 to 120 days depending on the service, backups up to 130 daysAs of 2026-07-30Deletion starts 90 days after cancellation, production data after 40 to 120 days depending on the service, backups up to 130 daysOpen sourceFor ticketing, help centre and forum the vendor names 40 days in production and 130 days in backups, for live chat and messaging 120 days, for analytics 90 days. Once started the process cannot be reversed. Export is only possible in the 30 days after the term ends, which is considerably earlier.As of 2026-07-30
CertificationsScale for this point: Certificationsdocumented, no condition attached: Mehrere anerkannte Nachweise, benannt mit Norm, Fassung und Geltungsbereich, und bezogen auf den Anbieter selbst.documented, tied to a condition: Ein anerkannter Nachweis für den Anbieter belegt, der Bericht aber nur auf Anfrage, oder der Nachweis hängt an einem Tarif, oder der Geltungsbereich bleibt teilweise offen.documented, but unfavourable: Nur pauschale Nennung ohne Norm-Fassung und Geltungsbereich, oder bloße Selbstauskunft, oder die Nachweise gehören dem Infrastrukturanbieter statt dem Anbieter, oder der Prüfzeitraum ist erkennbar veraltet, oder die eigenen Angaben widersprechen sich.open on a point that decides usability: Kein Nachweis genannt und keine Sicherheits- oder Vertrauensseite vorhanden.documented, no condition attachedISO 27001:2022, ISO 27017:2015, ISO 27018:2019, ISO 27701:2019, SOC 2 Type II, PCI DSS, HIPAA programme, FedRAMP LI-SaaS, Cyber Essentials Plus, CSA STAR AI Level 1 and 2As of 2026-07-30Certifications under ISO 27001:2022, 27017, 27018 and 27701 plus SOC 2 Type II on requestOpen sourceThe SOC 2 report is released on request only and is not public. An attestation under the German C5 catalogue is not named on the trust page.As of 2026-07-30
EU AI Act, Article 50Scale for this point: EU AI Act, Article 50documented, no condition attached: Der Anbieter macht eine belegte Aussage, die die eigene Pflicht trägt, etwa Modelldokumentation und Zertifizierung nach ISO/IEC 42001; oder das Werkzeug enthält nachvollziehbar begründet kein KI-System im Sinne der Verordnung.documented, tied to a condition: Der Anbieter äußert sich zur Verordnung oder ordnet die eigene Funktion ein, eine benannte Zusage zu den Transparenzpflichten aus Artikel 50 fehlt aber; oder das Werkzeug enthält kein KI-System, das gegenüber Menschen auftritt, und der Anbieter schweigt.documented, but unfavourable: Das Produkt enthält KI-Funktionen, der Anbieter schweigt dazu oder trägt ein Selbstetikett ohne Nachweis; die Kennzeichnung ist vom Betreiber aber selbst setzbar.open on a point that decides usability: KI spricht im Produkt unmittelbar mit Endkunden und der Anbieter sagt zu Artikel 50 nichts; die Kennzeichnung lässt sich ohne Zusage des Anbieters nicht sicher setzen.open on a point that decides usabilityunclearThe vendor's trust page does not mention the European AI regulation, although the product contains generative features and automated replies. Anyone who has to meet the transparency duties under Article 50 gets no commitment here and must obtain it contractually.no source given · As of 2026-07-30
Audit loggingScale for this point: Audit loggingdocumented, no condition attached: Nachvollziehbares Protokoll über Zugriffe und Änderungen in allen Tarifen enthalten, mit benannter Frist und Ausleitung in eigene Systeme; oder die Nachvollziehbarkeit liegt vollständig in eigener Hand, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Protokoll vorhanden, aber an einen höheren Tarif oder einen kostenpflichtigen Zusatz gebunden, oder die Ausleitung fehlt in den unteren Stufen; Reichweite und Frist sind benannt.documented, but unfavourable: Protokolle sind nur anbieterseitig beschrieben, oder Reichweite und Frist bleiben offen, sodass sich Nachweispflichten nicht planen lassen.open on a point that decides usability: Öffentlich nicht belegt, ob der Kunde überhaupt ein auswertbares Protokoll erhält.documented, tied to a conditionaccess logs only with the paid Advanced Data Privacy and Protection add-on, available from Suite Enterprise upwardsAs of 2026-07-30Access logs, customer-managed encryption keys and masking sit in the paid add-on from Suite Enterprise upwards, with no public priceOpen sourceThis add-on bundles 90 days of access logs, encryption with your own key management service, extended deletion rules, masking of personal data and automatic redaction. The vendor publishes no price for it; depending on account type the purchase runs through the shopping cart or through the account representative. Important distinction: this add-on does not include regional hosting, which has its own separate add-on.As of 2026-07-30

What it really costs

Entry price

Support Team costs 19 EUR per seat per month on annual billing and covers email and ticketing only. Suite Team sits at 55 EUR, Suite Professional at 115 EUR. Suite Enterprise with Copilot is priced on request only. Monthly billing costs around 20 percent more according to the vendor.As of 2026-07-30Plan prices of 19, 55 and 115 EUR per seat per month, the Copilot, workforce engagement and contact centre add-ons, and outcome-based billing of automated resolutionsOpen source

As of 2026-07-30

What gets expensive

In three places. First the add-ons: Copilot costs 50 EUR per seat per month, the workforce engagement bundle another 50 EUR, the contact centre 82 EUR. Second consumption: automated resolutions by AI agents are billed separately by outcome, and the unit price does not appear on the pricing page. Third the obligations: a documented EU hosting location requires at least Suite Professional at 115 EUR, and access logs require Suite Enterprise plus an add-on with no public price. So anyone buying for regulatory reasons does not pay 19 EUR but starts at 115 EUR and negotiates the rest.

What it displaces

  • Shared mailbox for customer requests
  • Case tracking in spreadsheets
  • Ownership assigned by word of mouth

Interfaces

  • REST API on every plan
  • Webhooks and triggers
  • Data export to JSON, CSV and XML once support has enabled it
  • App marketplace and custom applications
  • Connection of your own key management through the paid add-on

Matching methods

  • Service BlueprintingA blueprint exposes which internal step hangs off which customer step, and ownership, deadline and history per case are the data that let you check that drawing against reality.
  • Value Metric PricingThe method asks whether the pricing unit grows with customer value, and per-seat billing is the counter-case that shows cost growing with team size rather than with delivered value.

Sources

  1. 1.Plan prices of 19, 55 and 115 EUR per seat per month, the Copilot, workforce engagement and contact centre add-ons, and outcome-based billing of automated resolutions (opens in a new tab)zendesk.de/pricing · As of 2026-07-30
  2. 2.EU hosting depends on the Data Center Location add-on, which is free of charge but only applies from Suite Professional upwards and is not activated automatically (opens in a new tab)support.zendesk.com/… · As of 2026-07-30
  3. 3.Without that add-on the vendor makes no hosting location commitment and moves account data between regions without notice (opens in a new tab)support.zendesk.com/… · As of 2026-07-30
  4. 4.Even with a region activated, named exceptions stay in the United States, among them voice text data, chat email reports and campaign data (opens in a new tab)support.zendesk.com/…/4408883599130-Regional-Data-Hosting-Policy · As of 2026-07-30
  5. 5.Access logs, customer-managed encryption keys and masking sit in the paid add-on from Suite Enterprise upwards, with no public price (opens in a new tab)support.zendesk.com/… · As of 2026-07-30
  6. 6.Data processing is part of the contract, standard contractual clauses Module 2 are incorporated, and the vendor self-certifies under the EU-US Data Privacy Framework (opens in a new tab)zendesk.de/company/data-processing-agreement · As of 2026-07-30
  7. 7.Sub-processors are named in full with purpose and location, and new ones are announced 30 days in advance (opens in a new tab)support.zendesk.com/…/4408883061530-Sub-processor-Policy · As of 2026-07-30
  8. 8.Bulk export is not enabled by default, must be requested from support, is missing on entry plans, and the CSV export omits comments and descriptions (opens in a new tab)support.zendesk.com/… · As of 2026-07-30
  9. 9.External language model providers do not train on customer data, while the vendor's own models are trained on sanitised service data (opens in a new tab)support.zendesk.com/… · As of 2026-07-30
  10. 10.Deletion starts 90 days after cancellation, production data after 40 to 120 days depending on the service, backups up to 130 days (opens in a new tab)support.zendesk.com/hc/en-us/articles/4408883628954 · As of 2026-07-30
  11. 11.Acquisition by a consortium led by Hellman & Friedman and Permira for about 10.2 billion dollars, completed on 22 November 2022 (opens in a new tab)permira.com/… · As of 2026-07-30
  12. 12.Certifications under ISO 27001:2022, 27017, 27018 and 27701 plus SOC 2 Type II on request (opens in a new tab)zendesk.de/trust-center · As of 2026-07-30
  13. 13.zendesk.de/about (opens in a new tab)As of 2026-07-30
  14. 14.zendesk.de/…/master-subscription-agreement (opens in a new tab)As of 2026-07-30

Last reviewed: 2026-07-30 by Dr. Oliver Gausmann, Convios GmbH

Details out of date? Let us know.

← Back to the toolbox