Paradrawthe legal stack, drawnnotice
Fin Trust Center — controls
1,699 words, 68 clausesno date on the pageread 11/10/2026source
·Opens in new tab |Fin's Trust Center
·Fin
·Fin upholds the highest standards for safety and security, including enterprise-grade testing and controls, internationally recognized compliance accreditations, and advanced protections for Fin AI Agent against LLM threats. security@fin.ai Privacy Policy
·Controls
·Infrastructure security
| Control |
|---|
| Auto Scaling Our infrastructure auto-scales to maintain high availability and support demand |
| Backups and monitoring On an application level, we produce audit logs for all activity, ship logs to ELK for analysis and use S3 for archival purposes. All actions taken on production consoles or in the Intercom application are logged. |
| Denial of Service (DoS) Protection Intercom has measures to protect against Denial of Service (DoS) attacks. |
| Disaster Recovery Intercom was built with disaster recovery in mind. All of our infrastructure and data are spread across 3 AWS availability zones and will continue to work should any one of those data centers fail. |
| Embargoed Countries Respected We block access to our product from an embargoed country based on the IP of the user. |
| Least privilege AWS Security Groups employed for our infrastructure are baselined regularly to maintain least privilege. IAM roles granted to intercomrades for our AWS production environment are baselined on a regular basis to maintain least privilege. |
| Network segmentation Network segmentation is implemented to separate sensitive systems and data from general user access networks. |
| Real-time monitoring and detection An endpoint monitoring tool / agent is deployed on all endpoints (corporate and production) to provide real-time monitoring, detection, and automated response to threats. |
| Status Page Intercom strives for 99.9% uptime on a monthly basis and notes all incidents which impact availability on our public status page. |
| Virtual Private Cloud All of our servers are within our own virtual private cloud (VPC) with network access control lists (ACLs) that prevent unauthorized requests getting to our internal network. |
·Organizational security
| Control |
|---|
| Background checks Intercom performs background checks on all new employees in accordance with local laws. The background check includes employment verification and criminal checks for US employees. |
| Employee confidentiality All employee contracts include a confidentiality agreement. |
| Endpoint encryption All corporate devices are encrypted to protect data in case of loss or theft. They can be remotely wiped to prevent data leakage if a device is compromised or lost. |
| Endpoint management We push updates to employee laptops such that they are on the latest, patched version of their required operating system. We require the use of a managed browser with only an approved set of browser extensions to ensure that only devices meeting our security standards can access our IDP and the applications secured by it. This control ensures that access to critical systems is restricted to compliant and secure devices, enhancing our overall security posture. |
| Endpoint protection All corporate laptops are configured with endpoint protection (EPP) with procedures in place to ensure infected machines cannot access our systems. |
| Mandatory security awareness training All employees undergo mandatory security awareness training on an annual basis. Certain higher risk roles go through additional training specific for their role and its associated risks, annually. |
| Zero Trust Architecture We adopt a zero trust security model where no user or system is trusted by default. We require a managed device with biometrics which meets our security bar before access to any critical services is granted. Tools are protected by our identity provider Okta. |
·Product security
| Control |
|---|
| Anti-abuse Sign-ups to the Intercom product are fingerprinted, assessed for risk, and blocked or allowed to continue as necessary. |
| Bug Bounty Our application is continually reviewed by a group of security researchers to look for weaknesses and vulnerabilities. We use Bugcrowd, which gives security researchers a platform for testing and submitting vulnerability reports. Our dedicated security teams respond to issues raised. |
| Customer Best Practices There are security features you can leverage to increase the security of your Intercom workspace. Check out our docs! |
| Customer Data Portability Customers can easily export and delete their data in compliance with GDPR and other data protection regulations. |
| Data Retention and Disposal Policies Workspace data is deleted within 30 days of a workspace being electively deleted by its teammates. Workspaces and all related data are deleted after 180 days of inactivity. |
| Encryption Intercom is served 100% over https. All data sent to or from Intercom is encrypted in transit using 256 bit encryption. Our API and application endpoints are TLS/SSL only and score an "A+" rating on Qualys SSL Labs' tests. This means we only use strong cipher suites and have features such as HSTS and Perfect Forward Secrecy fully enabled. We also encrypt data at rest using an industry-standard AES-256 encryption algorithm. |
| Multi-tenancy data protections Safeguards are in place such that data from one Intercom workspace can never be used or displayed within another workspace. |
| Password complexity Intercom enforces a password complexity standard and credentials are stored using a PBKDF function (bcrypt). |
| Penetration Testing We engage third-party security experts to perform detailed penetration tests on the Intercom application and infrastructure annually |
| Permissions We enable permission levels within the app to be set for your teammates. Permissions can be set to include app settings, billing, user data or the ability to send or edit messages. 1 to 10 of 14 results |
·Internal security procedures
| Control |
|---|
| Code Review Each pull request to the Intercom code repositories must undergo a peer review before it can be accepted and merged. |
| Incident Response Coverage A member of the security team is always online and checking for alerts either through general on-call or outside hours coverage. |
| Incident Response Process Intercom implements a protocol for handling security events which includes escalation procedures, rapid mitigation and post mortem. All employees are informed of our policies. Security incidents and assumed security breaches are reported to relevant authorities as necessary. |
| On-call coverage A member of engineering is on-call 24/7 to respond to alerts and pages. They can escalate directly to a security team member as needed. |
| Security Policies Intercom has developed a comprehensive set of security policies covering a range of topics. These policies are updated frequently and shared with all employees. |
| Vendor Risk Assessments We formally assess the security posture of all third-party vendors, with a higher bar for those which handle sensitive data or have access to critical systems. We require third-party vendors to provide evidence of their own security controls, such as SOC 2 or ISO 27001 certifications, or undergo periodic audits. |
·Data and privacy
| Control |
|---|
| Encryption at rest We also encrypt data at rest using an industry-standard AES-256 encryption algorithm. |
| Terms and Privacy Policy Intercom maintains a privacy policy in addition to our Terms of Service. It can be found at https://www.intercom.com/legal/privacyOpens in new tab. We also have additional Product Terms detailling, for example, the specifics of our AI features and our Phone and SMS related features. |
| Customer Data Portability Customers can easily export and delete their data in compliance with GDPR and other data protection regulations. |
| Data Retention and Disposal Policies Workspace data is deleted within 30 days of a workspace being electively deleted by its teammates. Workspaces and all related data are deleted after 180 days of inactivity. |
| Employee access control policies Access to customer data is limited to authorized employees who require it for their job. Any exceptional access to customer data happens with the consent of customers and has to be reviewed by the manager of the employee's engineering team thereafter, supplying a business need. |
| Regional data hosting Intercom services and data are hosted in Amazon Web Services (AWS) facilities in the USA (us-east-1), Dublin, Ireland (eu-west-1), and Sydney, Australia |
·Compliance
| Control |
|---|
| Compliance and auditing Intercom undergoes an external audit annually performed by external auditors to ensure ongoing compliance with information security controls. |
| CSA - Cloud Security Alliance CSA is a not for profit organisation which put together best practices for a company to follow to help ensure a secure cloud computing environment. |
| Health Data Hosting (HDS) Intercom is HDS (Hébergeur de Données de Santé) certified. Intercom customers are required to comply with applicable data protection legislation and local regulations with regards to personal health information. Customers that work with or in the French healthcare industry must comply with the PGSSI-S (global information security policy for the healthcare sector) and are required to implement a health information system in compliance with the PGSSI-S. |
| HIPAA - Health Insurance Portability and Accountability Act We maintain compliance with HIPAA - a federal law that requires the creation of standards and controls to protect electronic protected health information (ePHI) from being disclosed. |
| ISO 27001 - ISO 27001:2022 Certification Our information security management systems (ISMS) is assessed annually. Our certification shows that we have a system to manage risks related to the security of data we own and handle and that we respect all the best practices and principles within this International Standard. |
| ISO 27018 - ISO 27018:2019 Certification Additionally, we maintain compliance with ISO 27018, assessing our privacy posture. |
| ISO 27701 - ISO 27701:2019 Certification ISO/IEC 27701 is an international standard for privacy information management systems (PIMS). Certification shows that Intercom has put in place a system to include the privacy information management system (PIMS) requirements in the role of a personally identifiable information (PII) processor. |
| PCI compliance Intercom does not electronically store, process, or transmit any cardholder data on our systems or premises. Intercom is PCI-DSS compliant as a merchant, to the extent that our customers' cardholder data functions are completely outsourced to a validated third party: Stripe. Intercom has confirmed that Stripe, who handle storage, processing, and/or transmission of cardholder data, is PCI-DSS compliant as a Service Provider. All elements of the payment page(s) delivered to the consumer's browser originate only and directly from Stripe. |
| SOC2 Compliance SOC2 compliance ensures that Intercom has controls in place to process and manage customer's data. Compliance shows the excellence of controls in the realms of security, availability, and confidentiality. |
| Compliance Documentation We provide evidence of certification to all current and prospective customers. Existing and prospective customers can access copies of Intercom's compliance reports and certifications from this Trust Centre. Top |
·Ask Fin a question
·Request access to the Fin Trust Center to access AI powered responses.
·Vanta AI will index the resources in the Trust Center and provide a summarized answer to any compliance and security question.