Which Zendesk products fall under which compliance programme

Compliance coverage is per product, not per account. A given product, used a given way, either falls inside the scope of a programme or does not.

Compliance coverage is per product, not per account. "Our account is covered" is not a meaningful statement: a given product, used a given way, either falls inside the scope of a programme or it does not.

What is in scope, per programme

This is the position as published by Zendesk on 1 September 2026. It changes as products develop, so check it again before you rely on it for something that matters, and ask us to confirm the position for your own account.

Two differences worth knowing

The security programmes and the industry ones do not cover the same ground, and the gaps are where accounts drift out of scope without anyone noticing.

• Messaging platform (Sunshine Conversations) is in scope for SOC 2, the ISO standards and HDS France, and is not in the HIPAA list. That is the one place where the two healthcare programmes part company, and it is easy to miss because everything else about them matches.
• Contact Center and Quality Assurance are likewise in scope for SOC 2 and ISO, and not for HIPAA or HDS France.

So an account operating correctly under HIPAA can add exactly those and step outside the arrangement, while the interface treats it as an ordinary configuration change.

Marketplace apps are the usual gap

Apps are third-party software processing your data. They are not covered by the platform's own certifications, and installing one is a decision about a new supplier rather than a feature toggle.

Newer features arrive outside scope

A capability may join a programme later than it launches. On a regulated account, "it is available" and "it may be used" are different questions, and the table above answers only the second.

Before adding anything

On an account with compliance obligations, check the scope before installing an app, enabling a product or connecting an integration. Read the general position first and your own agreement second, because the agreement is what states what applies to you. Ask us and we will confirm it.

See also

• Security requirements for HIPAA-enabled accounts
• What the Advanced Data Privacy and Protection add-on gives you
• The Data Center Location add-on: where your data lives