The Zendesk Shared Responsibility Model

The Zendesk Shared Responsibility Model

Zendesk provides a highly configurable, rapidly scalable customer service platform to many of the world’s leading companies across a wide swath of industry sectors.  By helping our subscribers leverage our Cloud platform for their customer service needs, we allow them to reduce overhead, scale to meet demand, and provide beautifully simple interactions with their customers.  

Moving business into the Cloud brings not only the benefits described above, but can include ambiguity regarding which party is in charge of which control.  Not to worry, in order to keep this simple, below you’ll find our Shared Responsibility Model.  This framework clarifies which party is responsible for which controls related to the security and privacy of your data.  Whether you’re a conscientious admin, corporate security, compliance, or privacy official, or anyone else tasked with setting up appropriate controls for the use of Zendesk Services in your environment, this standard should clearly draw the lines you need to be aware of. 

To encapsulate it in one sentence, “Zendesk is tasked with the security of the Service itself, while you are tasked with the security within your particular instances of the Service”. 

1. Access Controls and Hygiene
2. Integrations
3. Data, Privacy, Compliance, and Regulatory Considerations
4. Monitoring
5. Maintenance
6. Security Incidents (Roles and Responsibilities)
7. Helpful Links
8. Change Log

Please note that capitalized terms shall have the meaning ascribed to them in the Zendesk Main Services Agreement (“MSA”).   

I. Access Controls and Hygiene
Controlling access to sensitive systems and the data within them is core to security principles. 

1. The Subscriber is responsible for all access controls to their instances of the service including:
   1. Provisioning, modification, ongoing hygiene, maintaining privilege accuracy, and de-provisioning of all users including end users and agents (be they on-premise, remote, or third party workforce) 
   2. Choosing and configuring the method of authentication into the service from supported offerings (may include passwords, MFA, SSO, etc)
   3. Configuring and monitoring aspects of session handling such as logouts, logged in devices, etc.
   4. Allowing or disallowing our support staff to enter your Support instance for assistance
   5. Configuring access to, and understanding the implications of use for Zendesk’s REST API services (where applicable, including integrations, use of the Zendesk Sunshine Service, etc.)
   6. Configuring any product supported IP restrictions where desired
   7. Considering other non-product related access controls such as which device types you permit agents to use when accessing your instances, as well as any applicable physical, logical, or policy controls for your users or permitted devices
2. Zendesk is responsible for all access controls to the systems underpinning the service including:
   1. Maintaining policies and procedures for safely provisioning, modification, ongoing hygiene, maintaining privilege accuracy, and de-provisioning of all users (including on-premise, remote, and third party workforce)
   2. Enforcing Role Based Access Control “RBAC”, the Principle of Least Privilege “PLP”, appropriate credential security including Multi-Factor Authentication “MFA” for all employee and contractor access to critical systems and applications containing subscriber’s Service Data
   3. Performing periodic checks on the above

II. Integrations 
Leveraging third parties can greatly improve efficiency, but also introduces security considerations.

1. The Subscriber is responsible for considering the security implications of leveraging all third party integrations it makes with the Service including:
   1. Integrations made via API and/or SDK
   2. Integrations made via installing Marketplace Apps or enabling third-party channels
   3. Integrations with any third party aiding subscriber by providing staff, tooling, code, or directly servicing Zendesk instances
2. Zendesk is responsible for carefully integrating reputable third parties into the service, including:
   1. Vetting and exercising ongoing due diligence for all Sub Processors
   2. Integrating acquisitions into the Service in a safe manner
   3. Ensuring any product partnerships and/or Service integrations with third parties have the proper security considerations 

III. Data, Privacy, Compliance, and Regulatory Considerations
Accounting for the data in use, its proper treatment, any relevant regulatory frameworks, and the importance of third party assurances is a must.

1. The Subscriber is responsible for proper treatment of the data they take in and use, including:
   1. Understanding the data types involved in their particular use case
   2. Treating such data in accordance with the data classification and privacy policies of their company, applicable laws relevant to the data itself, the users providing it, subscriber’s industry, and any relevant jurisdictions
   3. Choosing which channels they allow for communication with their instances of the service
   4. Maintaining instances and Service Data in accordance with any applicable compliance, legal, or regulatory frameworks for which subscriber’s industry, users, or use case may be in scope
   5. Providing Zendesk with alternate TLS certificates where host mapping to a non-Zendesk parent domain is desired for the encryption of traffic to and from Zendesk UI’s or API’s
   6. Understanding where data may not be encrypted in transit and treating such channels or protocols accordingly (primarily email, SMS, or third party integrations made at subscriber’s sole discretion which do not support encryption)
   7. Ensuring the data types involved in subscriber’s instance do not violate the terms and conditions of Zendesk’s Main Services Agreement (please refer to Zendesk MSA)
   8. Ensuring the level of uptime and disaster recovery subscriber chooses is in accordance with any policies or regulations subscribers are beholden to
2. Zendesk is responsible for: 
   1. Properly protecting all Service Data from disclosure at a Service level (i.e. infrastructure or code) 
   2. Encrypting data in transit to or from our UI’s or API’s over public networks 
   3. Encrypting all Service Data at rest
   4. Providing subscribers with information on data collected by in-product cookies as well as default use of the services 
   5. Accurately describing how we use Service Data, including Personal Data, in anonymized and non-anonymized manners to provide our Services or otherwise.
   6. Providing subscribers with tools and features which help them to meet their own obligations for the proper treatment of personal or regulated data.
   7. Complying with applicable laws and regulatory frameworks relevant to our service offerings and locations of business
   8. Obtaining and providing independent third party compliance assurances relevant to our service offerings

IV. Monitoring
Proper security requires insight into processes and activity.  

1. The Subscriber is responsible for the monitoring of all activity within their instances of the service, including:
   1. Monitoring user activity (either via UI views or API logs)
   2. Exercising due diligence on communications with unknown individuals or untrusted content derived via the service
   3. Maintaining logs or data pulled from the Service in accordance with any applicable regulations
2. Zendesk is responsible for monitoring processes and activity of the service itself, including:
   1. Privileged access and activities within the production network
   2. Incoming traffic to alert on or block known-bad submissions or IP addresses
   3. Service uptime
   4. Anomalous behavior within corporate or production network assets
   5. The security of code, infrastructure, traffic, and relevant employee or contractor personnel

V. Maintenance
Keeping systems and code up to date and patched can prevent many security issues. 

1. The Subscriber is responsible for maintaining and patching any systems or code beyond Zendesk architectural and/or contractual boundaries*, including:
   1. Its own infrastructure, including employee endpoints, networks, custom infrastructure, or third party middleware it uses to access the Zendesk Service(s) and/or to further process its Service Data prior to ingress, or upon egress from Zendesk systems  
   2. Its own non-standard code leveraged to provide additional functionality to the Zendesk Service(s), including internally or third party developed code Subscriber has developed itself or purchased for use with Zendesk Service(s). This also includes any custom code developed by Zendesk Professional Services at Subscribers request, provided the responsibility of such code and maintenance thereof has been turned over to the Subscriber as part of the custom engagement.
2. Zendesk is responsible for maintaining and patching all systems and code within its architectural and/or contractual boundaries, including:
   1. Its own logically managed infrastructure within hosting provider facilities used to provide the Service(s), including operating systems, security infrastructure and systems under its direct control, container and orchestration systems, etc.
   2. Its own physically and/or logically managed infrastructure used within the Zendesk corporate environment such as employee endpoints, corporate network infrastructure, etc.
   3. The proprietary code bases underpinning the Zendesk Service(s).

* Please note that although Marketplace Apps run from within Zendesk architectural boundaries, they are not covered under Zendesk’s standard Master Services Agreement, but are instead covered by specific terms between the Subscriber and App developers themselves as denoted in our Marketplace Apps Terms of Use. Maintenance of Marketplace Apps is the responsibility of the third-party developers of the Marketplace Apps.

VI. Security Incidents
Despite best efforts, things can sometimes go wrong.  How you recognise, respond, and recover from a security incident is key to successful mitigation and keeping customer trust.  This section lays out the roles and responsibilities of each party during security incidents. 

1. The Subscriber is responsible for any security incident or breach within their particular instances, which was not caused by, or made via vulnerabilities or incidents within the service itself, including 
1. Investigating and remediating any any suspected or actual breach within their particular instance caused by (i) insufficient access control or hygiene (including use of weak or exploitable public credentials), (ii) insufficient monitoring of user activities, (iii) failure to perform due diligence on communications or untrusted content derived via interactions with users, or (iv) any incident or breach brought on via integration with any third party, where such integration was made at the subscriber’s sole discretion.
2. Making any required notifications to government or law enforcement agencies, or end users related to breaches caused by Subscriber actions, integrated third parties, or related to Service Data Breach notifications received from Zendesk regarding Subscriber’s instance
2. Zendesk is responsible for controls for investigating security incidents, as well as notifying affected subscribers for Service Data Breaches occurring via the service itself, including 
   1. Having a documented Security Incident Response Policy as well as staff with relevant security roles and responsibilities
   2. Investigating anomalous activity
   3. Containing any confirmed Service Data Breach
   4. Notifying any affected subscribers or relevant government or law enforcement agencies where required by law.
   5. Ensuring robust backup and disaster recovery processes are in place and tested

VII. Helpful Links

Secure Customer Service with Zendesk Security

Zendesk Security Best Practices

Zendesk Legal portal

Access Controls and Hygiene

Managing security and user access in Zendesk Support (aggregated links)

User roles in Chat

User authentication in Chat

Granting Zendesk temporary access to your account

Integrations

Zendesk API

Zendesk Marketplace Apps

Zendesk Sub Processors

Zendesk Connect Sub Processors

Zendesk Partners

Data, Privacy, Compliance, and Regulatory Considerations

Zendesk In-Product Cookie Policy

Zendesk Main Services Agreement

Zendesk Data and Privacy Protection

Monitoring

Support instance Change Audit log (UI / API)

Support Ticket Events Audit Log API

Chat Dashboards

Chat History UI

Chat Incremental Exports and Real-Time API

Talk Dashboard

Talk Incremental API

Sunshine Custom Objects, Events, and Profiles API

Sell Real-Time/Firehose API

Should you have any further questions, please contact us at [e-mail]  

VIII. Change Log
June 16th, 2023

1. Addition of a change log
2. Addition of Section V Maintenance
3. Clarifying detail of incidents caused by use of weak or publicly exploitable credentials used by Subscribers and/or their End-users as the Subscriber's responsibility within section VI "Security Incidents"