What is an Intercom AI Product?
These are various products/features that incorporate Intercom’s proprietary technology and/or AI technology provided by third party AI providers. Broadly speaking, our AI Products can be broken down into:
Fin AI Agent
Copilot
AI in the Inbox features
AI in our Phone offering, including transcripts and Fin Voice
Pro
Fin Sales Agent
For a more in-depth look at our AI Products and their respective features, view the relevant documentation in our Help Center.
What terms apply to my use of an AI Product?
Your use of an AI Product is subject to the AI Product - Additional Product Terms.
What Third Party AI Providers are you utilizing?
We’re constantly evaluating the third party AI models and providers that we use (looking at metrics like resolution rates, hallucination rates, latency in responses) to ensure we continue to deliver the very best AI products to our customers. Third party AI providers that we can use to deliver an AI Product are listed on our Subprocessors List. The current list includes:
AWS Bedrock (listed as Amazon Web Services, Inc.) - utilizing Anthropic’s models within the AWS Bedrock infrastructure.
OpenAI, LLC
Anthropic, PBC
Microsoft’s Azure OpenAI
Google (Vertex)
ElevenLabs (text-to-speech function in Fin Voice)
Which models we use to deliver the services will depend on the AI Product you’re using, as well as whether you have a regionally hosted workspace enabled. We may also use a mixture of models to deliver a single AI Product.
AI Products and EU Regional Hosting
Our AI Products are offered to our EU regionally hosted customers in a manner that is compatible with our existing obligations regarding Regional Data Hosting. Our EU subprocessor list contains Third Party AI Providers who provide regional hosting options (currently Microsoft Azure, AWS and OpenAI). This means that any Customer Data used as part of the Input into an AI Product will be regionally hosted in accordance with the terms of your Regional Data Hosting Addendum.
What data can the Third Party AI Providers access?
By default, any data, content and information (in any format) submitted to the Intercom workspace by Customer, its Permitted Users and/or People, including, but not limited to, help center content and conversation data can constitute Input for AI Products. The customer can control what sources of data certain AI Products have access to. See Knowledge sources to power AI, agents and self-serve support for more details.
What can the Third Party AI Providers do with the Input?
The specific rights given to third party AI providers are set out in Section 7 of the AI Product - Additional Product Terms and are the rights to:
Use Input to deliver the AI Product to the customer (including for preparing customer specific in-workspace previews of some AI Products, e.g. Copilot).
Comply with applicable laws
Enforce their own policies and ensure Input doesn’t violate their obligations in relation to harmful, or illegal content as more specifically detailed in the third party AI provider’s Acceptable Use Policy. Third party AI providers run safety classifiers to check for such content in prompts submitted to their services. While the exact way in which these safety classifiers are run differs between third party AI providers, none of the processes requires the storing of Customer Data, even if the content is flagged for possible violation.
Does this mean a customer is subject to third-party terms when using an AI Product?
Yes, where needed, we have passed certain terms imposed by the Third Party AI Providers through to our customers. A full list of these third-party terms is set out in section 8.1 of the Additional Product Terms.
Are there restrictions on Third Party AI Providers?
All of our third party AI providers are subject to the following:
Zero Data Retention: Inputs and Outputs are not persistently stored by our third party AI providers. Input is only temporarily used to deliver Output before both are deleted. Note: Input may still be passed through third party AI providers’ safety classifiers to ensure no violation of their acceptable usage policies (AUP). These safety classifiers, however, do not review personal data.
No Training or Product Improvement: Intercom contractually restricts third party AI providers from using Inputs or Outputs to train or otherwise improve the third party AI providers' models or services.
What are safety classifiers/abuse detection mechanisms?
LLM providers typically reserve the right to review prompt meta-data (which does not include review of the prompt itself) to ensure compliance with their respective AUP and legal obligations. No prompts are stored by the third party LLM providers as part of this process.
What can Intercom do with the Input and Output?
Input and Output are considered Customer Data (see section 2 of the AI Product, Additional Product Terms). Section 3.2 of our Terms of Service specify the rights that Intercom has in relation to Customer Data, which is a right to access, use and display the Customer Data during the Term in order to provide and improve our Services. If your end user sends personal data as part of their message, or to the extent that there is any personal data contained in your Knowledge Hub content, that personal data will be sent to a Third Party AI during the processing.
We use Customer Data to improve our Services by fine-tuning specific AI models for Fin, which are then deployed in the Fin product used by our Customers. These models are trained using anonymized Customer Data. See Fin CX models for more information.
Customers can request to be opted-out of their Customer Data being used for model training. Refer to this help center article for further information.
Customer teammates can submit various types of content (e.g., articles, snippets, websites, conversations, tickets, PDFs) to be processed and stored in the customer’s Knowledge Hub in their workspace.
The internal Intercom ML service then processes the content, updating the RAG (Retrieval Augmented Generation) data stored in the Knowledge Hub. When a piece of content changes, the ingestion process re-runs for the new content. This process allows the Knowledge Hub to maintain a rich and dynamic content repository for use in generating accurate and context-aware responses.
Who is responsible for training Fin?
Customers have the ability to train Fin on knowledge content, guidance (how Fin behaves), and Procedures (what Fin does). In addition, you can train Fin to perform specific roles, such as Service Agent or Sales Agent. The Customer is responsible for providing Fin with the appropriate content, guidance and instructions/triggers for Procedures, including where the Customer is using Intercom template instructions, or AI generated instructions. It is the Customer’s responsibility to validate and test Fin’s training before setting it live.
Who is responsible for deploying Fin?
The Customer is uniquely positioned to be able to determine whether their intended use of an AI Product is appropriate, having regard to their own regulatory, industry-specific and legal obligations, taking into account the limitations set out in the AI Product Terms, in particular, section 5 (accuracy) and section 8 (restrictions on use) and the Intercom AUP.
Can I redact Personal Data from Customer Data before it is sent to the Third Party AI Provider?
We currently don’t offer any feature or third-party integration that allows for customers to redact personal data contained in an end-user interaction with Fin, before the data is processed as Input by the Third Party AI Provider.
What other contractual assurances is Intercom providing in relation to these Third Party AI Providers?
As subprocessors, each of the third party AI providers are subject to Section 7 of the DPA in place between you and Intercom - where we state:
Intercom will restrict the third party AI Provider’s access to Customer Personal Data only to what is strictly necessary to provide the Services, and Intercom will prohibit them from processing the Customer Personal Data for any other purpose.
Intercom imposes contractual data protection obligations, including appropriate technical and organizational measures to protect personal data, on the third party AI providers to protect Customer Personal Data to the standard required by Applicable Data Protection Legislation; and
Intercom remains liable and accountable for any breach of the DPA that is caused by an act or omission of the third party AI provider.
What security measures are you implementing to protect against known LLM security risks?
Intercom has implemented state-of-the-art security measures to protect Fin against a wide range of LLM threats, including those identified by the OWASP LLM Top 10. By consistently testing a variety of high-end LLMs and deploying rigorous internal controls, security protocols, and safeguards, Fin is able to achieve a high level of security and reliability while avoiding potential limitations and threats.
Refer to the Fin AI Security document for more details.
AI Product and HIPAA Compliance
Intercom has Business Associate Agreements (BAAs) in place with each of the relevant third party AI providers.
Fin and the AI Act
We’ve provided some guidance on Fin AI Agent and the AI Act.
Using AI Products to monitor customer service agent performance
Some of our Pro features (CX Score) allow customers to evaluate their customer support conversations. CX Score is not intended to help assess individual teammate performance, even when a teammate handles the entire conversation from start to finish. In conversations involving multiple participants (e.g. Fin starts the conversation and a teammate finishes it), the CX Score reflects the overall customer experience rather than individual contributions.
Under our existing Terms, customers are not permitted to use or rely on CX Score where it would materially influence decisions related to human agents and/or to evaluate the performance of such human agents. Such use could be classified as a high-risk AI system under the EU AI Act, which would be contrary to Intercom's AI Product Terms and Acceptable Use Policy.
Need more help? Get support from our Community Forum
Find answers and get help from Intercom Support and Community Experts