Fin Trust Center

·Opens in new tab |Fin's Trust Center

·Fin

·Fin upholds the highest standards for safety and security, including enterprise-grade testing and controls, internationally recognized compliance accreditations, and advanced protections for Fin AI Agent against LLM threats. security@fin.ai Privacy Policy

·Compliance

·SOC 2 ISO 27001:2022 ISO 27018 ISO 27701 ISO/IEC 42001:2023 GDPR CCPA HIPAA HDS AIUC-1 CSA STAR EU AI ACT CSA Star for AI

·Resources

·View all

·AI Security

·Fin AI security Fin and the AI Act Intercom ISO 42001 Certificate AIUC-1 Certification Report View 1 more

·Security Assessments

·SOC 2 Type 2 Report ISO 27001, 27018, 27701 Certificates Statement of Applicability Déclaration d'applicabilité HDS View 1 more

·Cloud Security

·CSA CAIQ Self-Assessment CSA Star for AI

·Vulnerability Assessments

·Penetration Test (2025) Penetration Test (2024)

·Healthcare Reports

·HIPAA Report HDS Certificate

·Cyber Insurance

·Certificate of cyber insurance

·Terms & Policies

·Data Processing Addendum Opens in new tab

·Subprocessor Information

·Other resources

·AI-CAIQV1.1.0-star_security_questionnaire.xlsx

·Controls

·View all

·Infrastructure security

• ·Auto Scaling Backups and monitoring Denial of Service (DoS) Protection

·Organizational security

• ·Background checks Employee confidentiality Endpoint encryption

·Product security

• ·Anti-abuse Bug Bounty Customer Best Practices

·Internal security procedures

• ·Code Review Incident Response Coverage Incident Response Process

·Data and privacy

• ·Encryption at rest Terms and Privacy Policy Customer Data Portability

·Compliance

• ·Compliance and auditing CSA - Cloud Security Alliance Health Data Hosting (HDS)

·Data collected

·Customer personally identifiable information Employee personally identifiable information Personal health information Credit card information

·Subprocessors

·View all

·Amazon Web Services, Inc. • Hosting, storage and processing (including AI processing) of Customer Data USA or EU dependent upon customer's selected region

·Cloud infrastructure and services provider supporting data processing activities on behalf of Intercom

·OpenAI, L.L.C. • AI processing USA or EU dependent upon customer's selected region

·OpenAI is an AI research and deployment company. Our mission is to ensure that artificial general intelligence benefits all of humanity.

·Mailgun Technologies, LLC • Email delivery services for individual emails and bulk email campaigns initiated from Intercom's services USA

·Mailgun is the all-in-one, intelligent email delivery platform trusted by businesses, loved by developers

·Message Systems, Inc. (d/b/a Sparkpost) • Email delivery services for individual emails and bulk email campaigns initiated from Intercom's services USA

·SparkPost is an email delivery platform that helps businesses of all sizes predict and monitor ISP responses, email bounce rates and spam traps in real-time

·Updates

·View all Compliance

·🚀 Intercom achieves AIUC-1 certification: A new standard for trust in AI Agents

·Published December 9, 2025

·Intercom is now among the first companies certified under AIUC-1, the new global benchmark for responsible AI.

·This certification isn't compliance for compliance's sake. It gives every business using Intercom confidence that our AI is safe, resilient, and built to the highest level of accountability. Achieving it required independent, enterprise-grade testing of our AI systems, ensuring safety, reliability, and strong protections against issues like hallucinations and brand risk.

·It confirms that Intercom's long-standing commitment to trust fully extends to Fin. And it gives every business using Intercom confidence that our AI won't make unsafe choices, leak data, or behave unpredictably.

·🔗 Read the full blog post on our AIUC-1 certification and what it means for Intercom customers hereOpens in new tab or check out our AIUC-1 certification report in the Trust Center hereOpens in new tab. Security

·🚨 Malicious phishing targeting Intercom customers

·Published October 17, 2025

·We've identified phishing campaigns impersonating Intercom, targeting customers' support addresses.

·⚠️ Intercom has not sent any emails about MFA-related incidents.

·Be alert for lookalike domains such as send[.]intercorn[.]com. Attackers are using legitimate email-sending services, which can allow these messages to reach inboxes.

·If you receive an unexpected email that appears to come from Intercom:

• ·✅ Check the sending domain - never trust a display name.
• ·⏳ Be cautious of urgency - phishing relies on pressure and fear.
• ·💬 Confirm via another channel - you can always reach us through the Intercom Messenger.
• ·🛑 Pause if something feels off - even a brief moment of caution helps.

·🔗 Learn more and see examples in our help article: Oct 2025: Malicious phishing targeting Intercom customersOpens in new tab Security

·A new, secure way to authenticate Messenger users - with JWTs

·Published July 29, 2025

·We've introduced a new way to authenticate users in the Messenger, using JSON Web Tokens (JWTs).

·With JWTsOpens in new tab, you benefit from:

• ·✅ Data protection - Sign and protect both user ID and email, along with any other user attributes.
• ·✅ Short-lived tokens - JWTs can be set to expire, reducing the risk of misuse for compromised tokens.

·If your Messenger is in an insecure state, there's no better time to secure things. An insecure Messenger puts your workspace at risk of unauthorised access, cross-user impersonation, data spoofing and more. Learn more about how to secure your Messenger on our help centre.Opens in new tab

·This update replaces the previous Identity Verification (IdV)Opens in new tab method with features designed to protect user data. If you're using Identity Verification, migrate to JWTsOpens in new tab to benefit from these improvements. Identity Verification will continue to work, but is considered deprecated and will not receive future updates.

·You'll find the new JWT configuration in the Security tab within your Messenger settings.Opens in new tab

·Ask Fin a question

·Request access to the Fin Trust Center to access AI powered responses.

·Vanta AI will index the resources in the Trust Center and provide a summarized answer to any compliance and security question.