Freshworks

GDPR overview

GDPR implementation is documented and unusually concrete. A dedicated page states that Freshworks enables GDPR support for all customers worldwide, not only European ones. A Data Processing Addendum is published and offered to every customer; the sub-processor list is public, with 15 days' notice before any addition or replacement and a right for the customer to suspend or terminate; and the Technical and Organisational Measures are published separately. A Data Protection Officer is reachable at dpo@freshworks.com or by post in San Mateo. European entities are named in the privacy notice: Freshworks SAS in France, Freshworks GmbH in Germany, Freshworks Technologies B.V. in the Netherlands and Freshworks Technologies UK Limited. Transfers out of the EU rely on standard contractual clauses, TOMs and transfer impact assessments, alongside EU-U.S. and Swiss-U.S. Data Privacy Framework participation. One gap: no Article 27 EU representative is named on the pages reviewed.

Who owns the data?

The Terms of Service are explicit: the customer keeps what it puts in. Customer retains all right, title, and interest (including any and all intellectual property rights) in and to its Customer Data, and that data is treated as the customer's Confidential Information. Freshworks receives only a non-exclusive, worldwide, royalty-free licence, limited to what is necessary to provide, maintain and improve the Freshworks Technology. It keeps ownership of its own platform and of the Usage Data derived from service use. The customer alone answers for the accuracy, content and legality of its data. Customer names, logos and use cases may appear in Freshworks marketing unless the customer asks for that to stop.

Reuse rights

Customers can download, export or delete their Customer Data at any time during the subscription and reuse it as they see fit: nothing in the terms restricts what they do with their own records, and no permission has to be asked. The interesting detail runs the other way. Section 7b lets Freshworks collect and use any data derived from use of the Services, defined as Usage Data, to develop, improve, support, and operate its products and services; such data is not shared with third parties where it would expose the customer's confidential information, unless aggregated and anonymised. The privacy notice relies on legitimate interest to perform analytics and train Freshworks algorithms, and call recordings are used for product improvement, including training applications to better recognise human speech. An analytics opt-out exists: in-product for Freshchat, Freshworks and Freshmarketer, and in writing to dpo@freshworks.com for the other products. AI services themselves can be enabled or disabled from the admin console. Freddy AI mixes proprietary models, fine-tuned open-source models and commercial LLMs, with Microsoft Azure OpenAI listed as a sub-processor, and Google Workspace APIs are explicitly excluded from generalised AI or ML model training. No explicit opt-out from model training itself is documented on the pages reviewed.

Data retention & training

Hosting summary

Almost all data stored, processed and transmitted through Freshworks products sits on Amazon Web Services data centres. Five regions are published, US, EU, AUS, IND and ME, but no full country names are given. The region depends on the customer's location or chosen plan and is selected at signup, with Freshservice exposing a Data Center Location setting. Production and backup instances sit in the same region, and data stays in its data centre except where it is moved for performance or availability reasons or by specific agreement with the customer. One documented exception: call recordings are generated in the United States before being moved to the instance's regional data centre. On the security side, Freshworks runs dedicated VPCs, AES 256-bit encryption at rest, TLS 1.2 in transit, IAM with two-factor authentication, administrative access through a Teleport tunnel and n+1 multi-AZ redundancy. Backups replicate in near real time to other AWS availability zones, with daily snapshots kept for seven days. The privacy notice adds that personal data is processed in the countries where Freshworks is established: the United States, the United Kingdom and the European Economic Area.