Help Scout and the GDPR: AI training, data location and DPA

Trains on your data unless you switch it off.

Yes: de-identified, aggregated customer data is used to train and develop Help Scout's AI unless you opt out by email; it does not retrain OpenAI's base model

Vendor's wording: “Help Scout may use Training Datasets to perform its obligations under these Terms and for any other lawful business purpose, including but not limited to data analysis and to train and develop Help Scout’s artificial intelligence offerings.”

Source: helpscout.comTerms of Service > 5.4 AI PracticesChecked on 19 October 2026

You can switch the training off.

Email help@helpscout.com to opt out of your data being used for training datasets; customers with a signed BAA are opted out automatically

Vendor's wording: “Customer may opt out of having Customer Data used for creating Training Datasets at any time by emailing help@helpscout.com.”

Source: helpscout.comTerms of Service > 5.4 AI PracticesChecked on 19 October 2026

United States: hosted in AWS; the sub-processor list shows AWS in the USA

Vendor's wording: “Help Scout is hosted in AWS and maintains high standards for availability, backups and recovery on behalf of its customers.”

Source: helpscout.comSecurity > HostingChecked on 19 October 2026

DPA in the terms.

Yes: the Data Processing Amendment is incorporated by reference into the Terms of Service (no signature step stated)

Vendor's wording: “which is incorporated by reference into this Agreement.”

Source: helpscout.comTerms of Service > 5.2 Personal Data and PHIChecked on 19 October 2026

Published.

Yes, public at https://www.helpscout.com/company/legal/sub-processors/ (last revised Jan 2025): 20 entries. AI providers: OpenAI, Anthropic, Google, plus Freeplay (AI quality control) and Pinecone (vector store)

Vendor's wording: “Below is a list of sub-processors we work with.”

Source: helpscout.comList of Sub-processorsChecked on 19 October 2026

On the list, under review.

Active (Help Scout; EU-US DPF, UK Extension, re-certification under review)

Source: dataprivacyframework.govSearch 'Help Scout'Checked on 19 October 2026

After account termination Help Scout deletes (or on request returns) personal data, normally no later than 90 days; no chat retention period during use is stated

Vendor's wording: “Upon termination of your account, Help Scout will delete, or at customer's request, return all personal data”

Source: helpscout.comDPA > Return and deletionChecked on 19 October 2026

SOC 2 Type 2 (Security and Availability), report on request; HIPAA compliance with a signed BAA (1 certification, 1 compliance claim)

Vendor's wording: “Help Scout is SOC2 Type 2 certified for Security and Availability.”

Source: helpscout.comSecurity > SOC2Checked on 19 October 2026

Partly: AI Answers is off by default and enabled in Beacon settings; to remove all AI features from the account, contact Help Scout (no self-serve master switch stated)

Vendor's wording: “If you’d like to fully remove access to AI features in your account, please reach out to help@helpscout.com for assistance.”

Source: helpscout.comAI Transparency > Quick referenceChecked on 19 October 2026