EU-hosted helpdesk: customer data stays in the EU/EEA

The short answer: Supportifier is a helpdesk and AI customer service platform hosted in the EU. Customer data is stored within the EU/EEA, we sign a data processing agreement with every customer, and tickets are never used to train AI models. This page lists what that means in practice, and what we do not offer, so you can compare without asking.

Where the data is stored

All customer data in the service is stored within the EU/EEA: tickets, knowledge base, chat transcripts, call transcripts and customer data fetched from connected systems. We make no third-country transfers of customer data in the service. Details about the hosting are available on request.

Visitor statistics on the website are a different matter and are governed by the cookie consent on supportifier.se: with consent they are processed by Google, OpenAI and Apollo, which may transfer them to the United States. That never touches the data inside the service.

What the AI does with your data

The AI runs on Anthropic's Claude models through their API. Ticket text sent there is not used to train the provider's models, and we do not train our own models on customer tickets either.

What the system does learn is kept inside your account. When an agent sends an answer, it is not stored raw: names, personal identity numbers, email addresses, phone numbers and customer-specific details are removed and the question is generalised before anything is kept as reusable knowledge. Learned articles can never be published in the public help centre, so customer details never become help articles.

Agreement, retention and your rights as controller

You are the data controller and Supportifier is the processor. A data processing agreement is signed with every customer as standard, and retention periods are governed by the contract. Access requests and erasure requests are handled by searching for the email address in the inbox and deleting the tickets. At the end of the contract you can request an export of tickets, knowledge base and articles, since the content remains yours.

Security controls

• Integration keys are stored encrypted (AES-256-GCM) per customer, API keys are stored as SHA-256 hashes, and all traffic runs over HTTPS.
• Customer data is separated per workspace at database level: every database read filters on the workspace, and that separation is tested automatically on every code change.
• Sign-in uses Google SSO with domain restriction: only the email domains you approve are let in. There are two permission levels, agent and administrator, and an event log shows who changed what in the settings.
• Public AI surfaces, the chatbot and the AI form, are rate-limited per caller and capped per day per customer.
• Customer data from connected systems is shown to agents and used by the AI, but is never sent out raw and never exposed in the customer portal.

What we do not offer

Being precise about the gaps is part of being EU-friendly. There is no SAML or OIDC federation to your own identity provider, no SCIM provisioning and no two-factor sign-in beyond what Google provides; the SSO is Google sign-in with a domain rule. Dedicated hosting with data in a specific country is prepared in the architecture but is not a packaged offering; ask us before you count on it. Supportifier stores no call audio: when call assist is switched on, Amazon Connect records the call to produce the transcript, and the recording stays in your own Amazon Connect instance within the EU. Calls cannot be played back in Supportifier.

Questions buyers ask

Is Supportifier GDPR compliant? The service is built to be used in line with the GDPR: EU/EEA storage, a data processing agreement, retention by contract and tools for access and erasure requests. Compliance is a property of how you use it as controller, so ask for the security documentation and the DPA for your setup.

Can we get a security questionnaire answered? Yes. Ask for the security documentation and the data processing agreement; the security page summarises the controls.

Does the AI see our customers' personal data? The AI reads the conversation and, when the customer is identified and a connection exists, order, delivery and payment data, in order to answer. It does not train on it, and what is kept as knowledge has personal data removed first.

Read more on the security page and the platform page.