Freshworks runs regional data centers in the US, EU (Frankfurt), India, and Australia. The choice you make at provisioning is largely permanent. Get it wrong and migration is expensive.
Pick region by data subjects, not headquarters
A US-based company serving EU customers must use the EU data center. The Schrems II ruling makes “stored in EU” a near-mandatory contract term for many EU enterprise buyers. Provision in EU even if your finance team is in California.
Confirm the actual region
Your domain (yourcompany.freshdesk.com) does not encode the region. Check Admin → Account Settings → Data Center to confirm. New tenants since 2024 often default to closest region by signup IP, which may be wrong for your buyer base.
DPA and SCCs
Sign the Freshworks Data Processing Addendum and Standard Contractual Clauses before going live. The DPA covers Freshworks as processor; you remain controller. Without it, every customer record is a finding in your next audit.
Sub-processors list
Freshworks publishes a sub-processors page (AWS regions, payment processors, AI providers). Subscribe to the change-notification email. New AI sub-processors trigger a 30-day window where customers may object.
Right to be forgotten
Use the API to handle data subject deletion requests. The endpoint is hard-delete; there is no “undo.”
DELETE /api/v2/contacts/{id}/forget
// Removes the contact and all PII from associated ticketsFreddy AI and personal data
Freddy training does not use your tenant data to train shared models, by contract. Confirm this in your DPA addendum if your legal team needs the explicit term in writing.
Backup and export
Schedule monthly account exports via Admin → Account Settings → Account Data Export. Store encrypted at rest. This is your portability and audit evidence.
What to do this week
Verify your data center, sign the DPA + SCCs if not already done, subscribe to the sub-processors changelog, and test the right-to-forget API on a sandbox contact.
