Data

Zoho Desk and the GDPR: AI training, data location and DPA

Professional: Trains on your data, with no documented way to stop it. EU hosting available · DPA on request.

Vendor: Zoho Corporation Private LimitedPhone and voiceChecked on How we check

Verdict

Is Zoho Desk GDPR compliant?

Professional

Business

Trains on your data, with no documented way to stop it

EU hosting available · DPA on request

Price: See details

No tool is GDPR compliant on its own: that depends on how your business uses it. This page shows the vendor's side, from its own pages. It is not legal advice.

Training

Does Zoho Desk train on your data?

Trains on your data by default?

Checked

Trains on your data, with no documented way to stop it.

Yes, in a limited form: Zoho's privacy policy says it uses anonymised service data sets to improve the accuracy of its algorithms and uses your company data to build custom models for your company.

Vendor's wording: “(i) Wir nutzen anonymisierte Service-Datensätze, um die Genauigkeit der Algorithmen zu verbessern; und (ii) wir verwenden Ihre Unternehmensdaten dazu, maßgeschneiderte Modelle für Ihr Unternehmen zu entwickeln.”

Source: zoho.comPrivacy policy: Automatisierung und künstliche Intelligenz (German page)Checked on

Location

Where does Zoho Desk store your data?

Where data is stored by default

Checked

Set by the country or region chosen at sign-up: Zoho assigns a regional cloud facility from that mapping and can migrate the account if the mapping changes.

Vendor's wording: “Der Standort der Cloud-Anlage, die für Sie als Server dient, hängt von der Zuordnung zwischen Ihrer Region bzw. Ihrem Land und den verfügbaren Cloud-Anlagen zum Zeitpunkt der Anmeldung ab.”

Source: zoho.comStandort der Cloud-AnlageChecked on

EU hosting on this plan

Checked

EU hosting available.

Yes in practice: Zoho runs EU data centres (Amsterdam and Dublin) and the account's data centre follows the country chosen at sign-up. No separate EU-only switch or plan condition is described.

Vendor's wording: “Zoho UK office and EU Datacenters (EU1 Datacenter - Amsterdam, Netherlands; and EU2 Datacenter - Dublin, Ireland)”

Source: zoho.comCyber Essentials Plus entry, Applicable toSecond source: zoho.comChecked on

Contract

Does Zoho Desk sign a data processing agreement?

Data processing agreement (DPA)

Checked

DPA on request.

Yes, on request: the organisation admin emails legal@zohocorp.com for Zoho's DPA and states which data centre the account is in.

Vendor's wording: “If you are the organization administrator and would like to sign a DPA with us, please drop an email to legal@zohocorp.com”

Source: zoho.comDPA paragraphChecked on

Processors

Who else handles Zoho Desk data?

EU–US Data Privacy Framework

Checked

Not listed.

No listing found for search term 'Zoho'

Source: dataprivacyframework.govSearch 'Zoho' returned 'Query returned no results'Checked on

Security

Which certifications and admin controls does Zoho Desk have?

Security certifications

Checked

Seven ISO certificates for all cloud services (27001, 27701, 27017, 27018, 9001, 20000-1, 22301), SOC 2 Type 2 (all cloud services) and SOC 2 + HIPAA Type 2, whose scope names Zoho Desk. Company-wide page; SOC 1 scope does not list Zoho Desk.

Vendor's wording: “Applicable to - Zoho CRM, Zoho Bookings, Zoho Survey, Zoho Forms, Zoho Desk, Zoho Expense, Zoho Checkout, Zoho Connect and CommunitySpaces”

Source: zoho.comCertifications: SOC 2 + HIPAA Type 2 entry, Applicable to (also ISO and SOC 2 Type 2 entries)Checked on

Admin controls for AI

Checked

Partly: the admin can turn certain sub-processors off (some are on by default, some off); an organisation-wide Zia switch is not confirmed.

Vendor's wording: “Some of the sub-processors will be enabled by default, and the admin will be given the option to turn it off”

Source: zoho.comNotes below directoryChecked on

The vendor doesn't say: switch-off, sub-processors, retention, price.

Alternatives

Zoho Desk alternatives that don't train on your data

Other phone and voice tools whose business plan doesn't train on your data and includes a DPA.

The five marks, in order: No AI training · EU hosting · DPA · Sub-processors listed · DPF or EU vendor. ✓ meets it, ✕ doesn't, – partly, ? not stated.

Tool · PlanVerdictYour five rules
  • Crisp

    Essentials · $95 / mo

    Doesn't train on your dataData in the EU by default · DPA in the terms

    ✓✓✓✓✓

  • RingCentral AI Receptionist

    standalone plan · $49 / mo

    Doesn't train on your dataEU hosting available · DPA in the terms

    ✓✓✓✓✓

  • Synthflow

    Enterprise · $30,000 / yr

    Doesn't train on your dataEU hosting available · DPA on request

    ✓✓✓✓✓

  • BOTfriends X

    See details

    Doesn't train on your dataData in the EU by default · DPA in the terms

    ✓✓✓?✓

  • Parloa AI Agent Management Platform

    enterprise, consumption-based · See details

    Doesn't train on your dataEU hosting available · DPA in the terms

    ✓✓✓?✓

If no plan gives you the training default or data location you need, the tool may not be the right fit. We design and build what your team is missing around your own rules, and keep it running after launch.

See what we build

Need something your tools can't do?

We design and build what your team is missing, around the way you already work and the data rules you set.

Book a callServices