Security overview

Last updated 1 October 2026

This page describes how Intercom Chat protects your workspace, in plain terms. It describes what is in place today. We do not claim certifications we do not hold: at the date above we have not been through a formal third-party audit such as SOC 2 or ISO 27001.

Keeping workspaces apart

Every company has its own workspace, and the database itself enforces that one company can never read another’s data. This does not depend on the application remembering to filter: the rule is applied by the database to every query, and it is tested against a real database on every change.

Who can see what inside a workspace

• Channel messages are visible to the channel’s members; private channels are invisible to everyone else.
• Direct messages are readable only by the people in them. Administrators cannot read them, and neither can our staff in the ordinary course of work.
• Guests see only the channels they were added to.
• Anything that lets an administrator view other people’s channel content is written to an audit log the Owner can read.
• Files are checked against the same rules before they are handed out.

Accounts and sign-in

• Passwords are stored only as strong one-way hashes (argon2id), and are checked against known breaches.
• Sign-in attempts are rate-limited, per address and per account.
• Single sign-on (SAML) and automatic user provisioning (SCIM) are available on higher plans, and a workspace can require them.
• Sign-in cookies hold a random value and we store only its fingerprint, so a copy of our database does not contain anything that could be used to sign in. They can be ended at any moment.
• Everyone can see and end their own sign-ins; Owners and Admins can end anyone’s, set how long sign-ins last, and sign everyone out.

Protecting data

• Everything travels over encrypted connections.
• Rules on higher plans can stop payment card numbers, bank account numbers, identity numbers and secret keys from being posted.
• Deleted messages are archived, not destroyed, and only a workspace Owner or Admin can delete them permanently. A workspace can also set how long messages are kept.
• Our AI features only see what the person using them could already open, and cannot post, change or delete anything.
• When a channel is shared with another company, only text is copied across. Each company keeps its own copy, decides who reads it on its side, and can stop sharing at any time.

Backups and recovery

Databases are backed up every night and kept for 14 days. A backup is only trusted once it has been restored into a scratch database and checked, so we know it contains your data and is not just an empty file.

Infrastructure

The service runs on servers in the Netherlands behind a network protection layer. Only the web ports are open to the internet; the database and internal services are not reachable from outside. Secrets are kept on the server and are never placed in the code.

Payments

Card payments are handled by Stripe and PayPal; we never see or store full card details. Cryptocurrency payments are received straight into wallets controlled with a hardware device; the server holds only public information and no way to spend.

If something goes wrong

If we learn of a breach that affects your data, we will tell the workspace Owner without undue delay, say what we know, and say what we are doing about it.

Reporting a weakness

If you think you have found a security problem, please email support@intercomchat.com and give us reasonable time to fix it before sharing it. Please do not access other people’s data or disrupt the service while you look. We will not take action against anyone acting in good faith.

Xypno Business Solutions Ltd. Questions? Email support@intercomchat.com.