About advanced encryption (ADPP add-on)

<body>
<div class="article-banners">
<div id="docs-wmp-link">
<a href="https://support.zendesk.com/hc/en-us/articles/5411234991258-plan" rel="noopener" target="_blank">What's my plan?</a>
</div>
<div class="article-banner" id="addon_adpp">
<table>
<tbody>
<tr>
<td>
<strong>Add-on</strong>
</td>
<td>Advanced Data Privacy and Protection (ADPP)</td>
</tr>
</tbody>
</table>
</div>
</div>
<div id="docs-ai-summary">
<p id="docs-ai-summary-toggle">Verified AI summary <span id="up-triangle">◀</span><span id="down-triangle">▼</span></p>
<p id="docs-ai-summary-content">The Advanced Encryption feature, part of the ADPP add-on, lets you secure data using your own Key Management Service (KMS). It encrypts sensitive data, ensuring control over access and compliance. While it supports various KMS providers and encrypts key user data fields, be aware of limitations like unsupported key rotation and potential feature degradation. Test in a sandbox environment before full implementation.</p>
</div>
<div class="body">
<div class="note fastpath" id="ac_advanced_encryption_overview__note_og3_b2r_hcc">
<span class="fastpathtitle">Location: </span> <span class="ph">Admin Center &gt; Account &gt; Security &gt; Advanced encryption</span>
</div>
<p class="p">The Advanced encryption feature, part of the <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/6561144266906" target="_blank">Advanced Data Privacy and Protection add-on</a>, enhances data
security by allowing your company to encrypt service data using your own enterprise Key
Management Service (KMS). This ensures that sensitive information stored in Zendesk
remains secure and inaccessible to unauthorized parties. Maintaining your own encryption
keys provides greater security and compliance while giving you complete control over
access and usage.</p>
<p class="p">You can turn on advanced encryption in your production or sandbox account. Zendesk
recommends testing it on sandbox first. See <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/5517626234138" target="_blank">Setting up advanced encryption</a> to learn more.</p>
<p class="p">This article covers the following topics:</p>
<ul class="ul" id="ac_advanced_encryption_overview__ul_f4k_znp_jcc">
<li class="li"><a class="xref" href="#topic_ghv_224_b2c">Understanding how advanced encryption works</a></li>
<li class="li"><a class="xref" href="#topic_tm1_1f4_b2c">Data encrypted in Zendesk</a></li>
<li class="li"><a class="xref" href="#topic_wbf_bf4_b2c">Advanced encryption vs. standard encryption</a></li>
<li class="li"><a class="xref" href="#topic_hc5_cf4_b2c">Advanced encryption limitations</a></li>
<li class="li"><a class="xref" href="#topic_i1q_st4_b2c">Data storage limitations</a></li>
</ul>
</div>
<div aria-labelledby="ariaid-title2" class="topic nested1" id="topic_ghv_224_b2c">
<h2 class="title topictitle2" id="ariaid-title2">Understanding how advanced encryption works</h2>
<div class="body">
<p class="p">When using advanced encryption, you manage your own encryption keys outside of
Zendesk. You can use any of the following supported Key Management Systems: AWS KMS,
Azure Key Vault, Google Cloud KMS, or Thales CipherTrust Manager, which is an
EU-based KMS based in Europe and managed and hosted by European companies.</p>
<p class="p">Advanced encryption relies on envelope encryption. On encryption, Zendesk generates a
Data Encryption Key (DEK) for the data chunk and requests the KMS to encrypt this
key. It then discards the plain key and keeps the encrypted key.</p>
<p class="p">Whenever Zendesk needs to access encrypted data, it will request the KMS to decrypt
the data key using the master key. This happens in transit; data is encrypted when
it comes into Zendesk before our applications process it, and it stays encrypted
until there's a use case that requires decryption.</p>
<p class="p">Data encryption doesn't impact the agent experience. Agents can continue to search
and access the data they are permitted to see based on their role. However, there
are a few <a class="xref" href="#topic_hc5_cf4_b2c">limitations</a>.</p>
</div>
</div>
<div aria-labelledby="ariaid-title3" class="topic nested1" id="topic_tm1_1f4_b2c">
<h2 class="title topictitle2" id="ariaid-title3">Data encrypted in Zendesk</h2>
<div class="body">
<p class="p">Advanced encryption supports backfilling and encrypting newly created and existing
users in your Zendesk account. </p>
<div class="note attention" id="topic_tm1_1f4_b2c__note_zqj_tml_d2c">
<span class="attentiontitle"></span> Key rotation and revocation are not yet
supported. If you rotate or revoke the keys, you might lose your encrypted data
forever. You can add a new key, which will be used to encrypt newly created data.
The old keys will continue to encrypt and decrypt the old data.</div>
<p class="p">Advanced encryption encrypts the following user fields and entities for end-user data
in Support and the knowledge and voice areas of Zendesk:</p>
<ul class="ul" id="topic_tm1_1f4_b2c__ul_h23_d44_b2c">
<li class="li">Name</li>
<li class="li">Alias</li>
<li class="li">Signature</li>
<li class="li">Details</li>
<li class="li">Notes</li>
<li class="li">Email address</li>
<li class="li">Social channel <a class="xref" href="https://developer.zendesk.com/api-reference/ticketing/users/user_identities/" target="_blank">user identities</a>
</li>
</ul>
<p class="p">The fields listed above are encrypted in the following areas of Zendesk Support:</p>
<ul class="ul" id="topic_tm1_1f4_b2c__ul_nwj_h44_b2c">
<li class="li" dir="ltr">End-user management</li>
<li class="li" dir="ltr">Team-member management</li>
<li class="li" dir="ltr">User data in the context of a ticket (requester, CC, followers,
assignee)</li>
<li class="li" dir="ltr">Group and organization memberships</li>
<li class="li" dir="ltr">User placeholder resolution in ticket comments and emails</li>
<li class="li" dir="ltr">User creation through single sign-on, Web Widget, and email</li>
<li class="li" dir="ltr">Ticket views</li>
<li class="li" dir="ltr">Support search</li>
<li class="li" dir="ltr">Triggers and automations (business rules)</li>
<li class="li" dir="ltr">Support users created through messaging conversations</li>
<li class="li" dir="ltr">Side conversations</li>
</ul>
<p class="p">All knowledge- and voice-related features are covered, except @mentions in help
center, which will be turned off if encryption is activated.</p>
</div>
</div>
<div aria-labelledby="ariaid-title4" class="topic nested1" id="topic_wbf_bf4_b2c">
<h2 class="title topictitle2" id="ariaid-title4">Advanced encryption vs. standard encryption</h2>
<div class="body">
<p class="p">Advanced encryption complements standard encryption used by all Zendesk accounts.</p>
<div class="p">
<div class="tablenoborder">
<table border="1" cellpadding="4" cellspacing="0" class="table" frame="border" id="topic_wbf_bf4_b2c__table_cyb_3p4_b2c" rules="all" summary="">
<colgroup>
<col style="width:18.867924528301888%">
<col style="width:40.56603773584906%">
<col style="width:40.56603773584906%">
</colgroup>
<thead class="thead" style="text-align:left;">
<tr class="row">
<th class="entry cellrowborder" id="d48e213">State</th>
<th class="entry cellrowborder" id="d48e216">Advanced encryption</th>
<th class="entry cellrowborder" id="d48e219">Standard encryption</th>
</tr>
</thead>
<tbody class="tbody">
<tr class="row">
<td class="entry cellrowborder" headers="d48e213">
<p class="p"><strong class="ph b">In transit</strong></p>
</td>
<td class="entry cellrowborder" headers="d48e216">
<p class="p">Data is encrypted with customer-managed keys as soon as
possible at the HTTP proxy layer or equivalent entry
point.</p>
</td>
<td class="entry cellrowborder" headers="d48e219">
<p class="p">All communications with the Zendesk UI and APIs are encrypted
through industry standard HTTPS and Transport Layer Security
(TLS 1.2 or higher) over public networks. This ensures that
all traffic between you and Zendesk is secure during
transit.</p>
<p class="p">For email, Zendesk leverages opportunistic TLS by default.
TLS encrypts and delivers email securely, mitigating
eavesdropping between mail servers where peer services
support this protocol. Exceptions for encryption may include
any use of in-product SMS functionality, any other
third-party app, integration, or service subscribers that
customers may choose to leverage at their discretion.</p>
</td>
</tr>
<tr class="row">
<td class="entry cellrowborder" headers="d48e213">
<p class="p"><strong class="ph b">At rest</strong></p>
</td>
<td class="entry cellrowborder" headers="d48e216">
<p class="p">Data in the database remains encrypted. If a third party or
foreign government attempts to get access to a running
database, the data will be returned in ciphertext.</p>
</td>
<td class="entry cellrowborder" headers="d48e219">
<p class="p">Service Data is encrypted at rest in AWS using AES-256 key
encryption.</p>
</td>
</tr>
<tr class="row">
<td class="entry cellrowborder" headers="d48e213">
<p class="p"><strong class="ph b">In use</strong></p>
</td>
<td class="entry cellrowborder" headers="d48e216">
<p class="p">The data remains encrypted while in use and is only decrypted
if a use case requires it. Any decryption actions are logged
and auditable when leveraging an external Security
Information and Event Management (SIEM) integration.</p>
</td>
<td class="entry cellrowborder" headers="d48e219">
<p class="p" dir="ltr">Data fetched from the data stores is processed in
plaintext.</p>
</td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
</div>
<div aria-labelledby="ariaid-title5" class="topic nested1" id="topic_hc5_cf4_b2c">
<h2 class="title topictitle2" id="ariaid-title5">Advanced encryption limitations</h2>
<div class="body">
<p class="p">Advanced encryption comes with some trade-offs that you should be aware of. When data
is encrypted, you may encounter functionality limitations and unavailable
features.</p>
<p class="p"><strong class="ph b">General limitations</strong></p>
<ul class="ul" id="topic_hc5_cf4_b2c__ul_v3c_lq4_b2c">
<li class="li">Any functionality outside of the scope described in <a class="xref" href="#topic_tm1_1f4_b2c">Data encrypted in Zendesk</a>,
including but not limited to legacy Chat, QA, integrations, and mobile, might be
broken or show encrypted data in the UI or API responses. For these reasons,
Zendesk encourages you to activate and test advanced encryption in a sandbox
account before activating it in production. </li>
<li class="li">Key rotation is not yet supported.</li>
</ul>
<p class="p"><strong class="ph b">Support limitations</strong></p>
<ul class="ul" id="topic_hc5_cf4_b2c__ul_t31_vq4_b2c">
<li class="li">Ticket sharing is not yet supported.</li>
<li class="li">Encrypted accounts will become ineligible for account region moves. If you wish
to move your data to a different region, request the move before activating
advanced encryption.</li>
<li class="li">
<a class="xref" href="https://support.zendesk.com/hc/en-us/articles/6150628316058" target="_blank">Sandbox environments</a> can't be created
after activating advanced encryption.</li>
<li class="li">Messaging triggers with conditions based on an end-user name won’t work.</li>
<li class="li">Only email addresses are encrypted. Email HTML source files, as well as the
subject line email body, are not encrypted.</li>
</ul>
<div class="p">
<strong class="ph b">Search-related degradation</strong><ul class="ul" id="topic_hc5_cf4_b2c__ul_yvl_dr4_b2c">
<li class="li">Snippet highlighting, wildcard search, phrase search, and non-space
delimited languages (such as Chinese and Japanese) won’t work.</li>
<li class="li">Search match and ranking might be different.</li>
<li class="li">Searching for side conversations by user name won’t work. Instead, search by
the subject line of the side conversation or parent ticket.</li>
</ul>
</div>
<div class="p">
<strong class="ph b">Views-related degradation</strong><ul class="ul" id="topic_hc5_cf4_b2c__ul_un1_qr4_b2c">
<li class="li">Support views sorting by user name (requester and assignee) will be turned
off for accounts with encryption activated.</li>
<li class="li">Support views grouped by user name (requester and assignee) will display
user names that are out of order.</li>
<li class="li">CSV exports will display placeholders instead of user names.</li>
</ul>
</div>
<p class="p"><strong class="ph b">Imports and exports degradation</strong></p>
<ul class="ul" id="topic_hc5_cf4_b2c__ul_id3_zr4_b2c">
<li class="li">User fields and identities imported through the <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408893496218#topic_nly_lm1_5cc" target="_blank">bulk actions importer</a> will not be
encrypted. User fields added through the <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408893496218#topic_syb_lm1_5cc" target="_blank">data importer</a> will be encrypted, but
user identities added through the data importer will not be encrypted.</li>
<li class="li">XML exports for users will not be supported, but CSV and JSON exports are
supported.</li>
</ul>
<p class="p"><strong class="ph b">Help center degradation</strong></p>
<ul class="ul" id="topic_hc5_cf4_b2c__ul_uh2_5s4_b2c">
<li class="li">@mentions will be turned off. </li>
</ul>
</div>
</div>
<div aria-labelledby="ariaid-title6" class="topic nested1" id="topic_i1q_st4_b2c">
<h2 class="title topictitle2" id="ariaid-title6">Data storage limitations</h2>
<div class="body">
<p class="p">Advanced encryption introduces a new way of encrypting sensitive data using Customer
Managed Keys (CMK). To ensure Zendesk’s functionality is not compromised, Zendesk
services decrypt sensitive data while processing requests originating from many
channels, including browsers, REST APIs, and email. Zendesk guarantees that
plaintext data is never stored in permanent storage and is only kept for the minimum
amount of time necessary to fulfill the request.</p>
<p class="p">The following items are current exceptions:</p>
<ul class="ul" id="topic_i1q_st4_b2c__ul_r5n_3t4_b2c">
<li class="li">Gateway (NGINX + Cloudflare) stores public help center pages, which might
contain user profile data for up to three minutes.</li>
<li class="li">Outbound email temporarily stores email bodies before the email is delivered by
Simple Mail Transfer Protocol (SMTP).</li>
<li class="li">The <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408832876442" target="_blank">original email body</a> of inbound email
is maintained after the ticket or comment is created and powers additional
collaboration features.</li>
<li class="li">Explore user datasets are stored in plaintext.</li>
<li class="li">Bulk import and export files are temporarily stored in plaintext for 30 days.
The files are deleted after 30 days. </li>
<li class="li">User data in Sunshine Conversations datastores is stored in plaintext. (Support
datastores are covered.)</li>
<li class="li">User data in real-time services (for example, agent presence and the call
console) is retained in plaintext for up to seven days to power the agent
UI.</li>
<li class="li">Agent and admin user data will appear in plaintext for customer sales and
support cases to assist customers.</li>
</ul>
</div>
</div>
<script id="fast-path-script">
//<![CDATA[
const fast_path_style = document.createElement('style');
fast_path_style.innerHTML = `#article-body .fastpath{font-size:.9em;background-color:#f3f3f3;border:1px solid #d3d3d3;padding:10px 10px 8px;margin-bottom:16px}#article-body .fastpath::before{content:none!important}`;
document.head.appendChild(fast_path_style);
//]]>
</script><script id="ai-summary-script">
//<![CDATA[
const ai_summary_style = document.createElement('style');
ai_summary_style.innerHTML = `#styled-article-body{padding:0 0 0}#article-body #docs-ai-summary{background-color:#f3f3f3;border:1px solid #d3d3d3;padding:10px 10px 6px;margin-bottom:16px}#article-body #docs-ai-summary #docs-ai-summary-toggle{font-size:.9em;font-weight:700;margin-bottom:4px;cursor:pointer;display:flex;justify-content:space-between;align-items:center}#article-body #docs-ai-summary #docs-ai-summary-toggle #up-triangle{margin-left:auto;padding-right:10px;display:none}#article-body #docs-ai-summary #docs-ai-summary-toggle #down-triangle{margin-left:auto;padding-right:10px}#article-body #docs-ai-summary #docs-ai-summary-content{font-size:.9em;padding-left:25px;padding-right:25px;margin-bottom:12px}`;
document.head.appendChild(ai_summary_style);

const toggleAISummary = () => {
const summary = document.getElementById("docs-ai-summary-content");
const upTriangle = document.getElementById("up-triangle");
const downTriangle = document.getElementById("down-triangle");
if (summary.style.display === "none") {
summary.style.display = "block";
upTriangle.style.display = "none";
downTriangle.style.display = "inline";
} else {
summary.style.display = "none";
upTriangle.style.display = "inline";
downTriangle.style.display = "none";
}
};

document.getElementById("docs-ai-summary-toggle").addEventListener("click", toggleAISummary);
//]]>
</script>
</body>