Security and compliance
Customer service agents: SOC 2, ISO 27001, GDPR and SSO
We checked 17 customer service agents against their makers' own pages. 8 hold SOC 2, 7 hold ISO 27001, 8 state GDPR or offer a DPA and 5 offer SSO with no plan limit.
| Customer service agents | SOC 2 | ISO 27001 | GDPR / DPA | SSO |
|---|---|---|---|---|
| AdaChecked | Partly | Not stated | Partly | Yes |
| AgentforceChecked | Yes | Yes | Not stated | Yes |
| AissistChecked | Yes | Yes | Not stated | Not stated |
| ChatbaseChecked | Yes | Not stated | Yes | PartlyEnterprise plan and up |
| CoSupport AIChecked | Not stated | Yes | Yes | Not stated |
| ForethoughtChecked | Yes | Yes | Not stated | Not stated |
| GorgiasChecked | Not stated | Not stated | Yes | Yes |
| ParloaChecked | Not stated | Not stated | Yes | Yes |
| PolyAIChecked | Yes | Yes | Yes | Partly |
| RobylonChecked | Not stated | Not stated | Not stated | PartlyEnterprise plan and up |
| SierraChecked | Yes | Yes | Yes | Not stated |
| TidioChecked | Not stated | Not stated | Yes | PartlyPremium plan and up |
| TypewiseChecked | Not stated | Partly | Partly | PartlyEnterprise plan and up |
| VidaChecked | Yes | Not stated | Not stated | Not checked |
| VoiceFleetChecked | Partly | Partly | Partly | Partly |
| Workforce WaveChecked | Not stated | Not stated | Yes | Partly |
| Zendesk AI agentsChecked | Yes | Yes | Not stated | Yes |
"Checked" is the oldest answer in the row. "Not stated" means the maker's pages don't say either way.
- SOC 2
- Holds a SOC 2 report, Type I or Type II.
- ISO 27001
- Is certified to ISO/IEC 27001.
- GDPR / DPA
- States GDPR compliance or offers a data processing agreement.
- SSO
- Lets a team sign in through its own identity provider (SAML or OIDC), with the plan it comes on.
The "Partly" answers
- Ada, SOC 2: Ada holds SOC 2 Type II and HIPAA, operates in compliance with GDPR, states PCI DSS compliance on the same page, and was the first CX platform certified against AIUC-1, with annual third-party penetration tests covering the LLM layer. Source,
- Ada, GDPR / DPA: Ada holds SOC 2 Type II and HIPAA, operates in compliance with GDPR, states PCI DSS compliance on the same page, and was the first CX platform certified against AIUC-1, with annual third-party penetration tests covering the LLM layer. Source,
- Chatbase, SSO: SAML single sign-on is available on Enterprise for signing in through an organization’s identity provider. Source,
- PolyAI, SSO: Google SSO sign-in is documented for Studio accounts; no SAML or OIDC enterprise SSO appears in the docs, and SSO assigns neither roles nor area permissions. Source,
- Robylon, SSO: Single sign-on appears only in the Enterprise column of the plan table, marked No on Starter, Pro and Business, while role-based access starts on Pro. Source,
- Tidio, SSO: Single sign-on appears only in the Premium column of the plan comparison table; the four cheaper plans carry a cross, with two-factor authentication offered instead. Source,
- Typewise, ISO 27001: ISO 27001 certification is claimed on the trust center alongside annual third-party penetration testing, with GDPR and EU AI Act alignment Source,
- Typewise, GDPR / DPA: ISO 27001 certification is claimed on the trust center alongside annual third-party penetration testing, with GDPR and EU AI Act alignment Source,
- Typewise, SSO: SAML single sign-on is an Enterprise feature: the comparison table leaves the SSO row empty for Starter, Growth and Business and ticks it only in the Enterprise column. Source,
- VoiceFleet, SOC 2: GDPR posture is documented in depth with a published DPA, SCCs, a subprocessor schedule and baseline security measures, but no SOC 2 or ISO 27001 certification is claimed and third-party assurance is offered only as whatever exists. Source,
- VoiceFleet, ISO 27001: GDPR posture is documented in depth with a published DPA, SCCs, a subprocessor schedule and baseline security measures, but no SOC 2 or ISO 27001 certification is claimed and third-party assurance is offered only as whatever exists. Source,
- VoiceFleet, GDPR / DPA: GDPR posture is documented in depth with a published DPA, SCCs, a subprocessor schedule and baseline security measures, but no SOC 2 or ISO 27001 certification is claimed and third-party assurance is offered only as whatever exists. Source,
- VoiceFleet, SSO: Google and Microsoft sign-in is documented as a customer-selected authentication integration, but no SAML or OIDC enterprise SSO is named anywhere, and no tier lists SSO as a feature. Source,
- Workforce Wave, SSO: Dashboard sign-in supports OAuth 2.0 social login with Google or GitHub plus TOTP multi-factor, but no SAML, Okta or SCIM enterprise identity provider integration is named on the security page. Source,
Use the data
How we check listings: methodology.