Freshdesk EU Alternative 2026: NASDAQ:FRSH Delaware Corp, India DPDPA No-Adequacy Gap, CLOUD Act Helpdesk Risk

Post #967 in the sota.io EU Compliance Series

Freshworks began in a Chennai apartment in 2010. Girish Mathrubootham and Shan Krishnasamy built the first version of Freshdesk after Girish experienced a particularly frustrating Zendesk support interaction. Their product succeeded by offering Zendesk-equivalent functionality at a significantly lower price point, winning millions of SMB customers globally. By 2021, Freshworks completed a NASDAQ IPO (ticker: FRSH) that valued the company at $10 billion — the first SaaS company founded in India to list on a US exchange at this scale.

For EU organisations evaluating Freshdesk today, the India founding story creates a dual compliance concern that distinguishes Freshworks from most US SaaS vendors.

First, Freshworks Inc. is incorporated in Delaware and headquartered in San Mateo, California — a US person under the Clarifying Lawful Overseas Use of Data Act (CLOUD Act, 18 U.S.C. § 2713). Customer support tickets processed through Freshdesk are compellable by US federal law enforcement regardless of server location.

Second, Freshworks retains substantial engineering and R&D operations in Chennai, India. India enacted the Digital Personal Data Protection Act (DPDPA) 2023 but has not received an EU adequacy decision. Personal data flowing from EU customers' Freshdesk accounts to Freshworks engineers in India for product development, incident response, or debugging faces a secondary transfer gap that Standard Contractual Clauses alone may not fully resolve under GDPR Article 46.

Who Freshworks Is — Corporate and Legal Structure

Freshworks Inc. is a Delaware corporation (IPO: September 2021, NASDAQ: FRSH) headquartered at 2950 S. Delaware Street, Suite 201, San Mateo, California 94403.

Key legal entities:

• Freshworks Inc. — Delaware C-Corp, NASDAQ-listed, ultimate parent (US person)
• Freshworks India Private Limited — Major R&D and engineering hub, Chennai and Hyderabad
• Freshworks GmbH — German entity for EU sales and local support
• Freshworks Technologies Ltd — UK entity
• Freshworks Canada Inc. — Canadian entity

Under 18 U.S.C. § 2713, disclosure obligations apply to the US parent corporation and extend to records held by entities under its control. A CLOUD Act order served on Freshworks Inc. in San Mateo extends to records held by Freshworks GmbH in Germany. EU data residency — Freshworks markets its EU data center option — does not alter this analysis. Corporate control, not data geography, determines CLOUD Act jurisdiction.

The India Dimension: DPDPA 2023 and No EU Adequacy

Most EU compliance analyses of US SaaS vendors stop at CLOUD Act. Freshworks requires a second layer of analysis because of its India operational footprint.

India's Digital Personal Data Protection Act (DPDPA) 2023 came into force August 2023. It establishes consent-based processing requirements and creates a Data Protection Board. It does not include:

• An independent supervisory authority equivalent to EU DPAs
• Adequacy recognition from the European Commission
• Equivalent restrictions on government access to personal data

The European Commission has not granted India an adequacy decision under GDPR Article 45. India is not on the adequacy list maintained by the EDPB. This means personal data transfers from EU data subjects to India require one of the Article 46 safeguards: Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs), or an approved code of conduct.

For Freshworks, the relevant question is: when EU customer data flows to Chennai or Hyderabad engineering teams — for debugging, feature development, training AI models, or responding to support escalations — what GDPR Article 46 mechanism covers that transfer?

Freshworks' Data Processing Agreement references SCCs for transfers to third countries. However, a 2021 EDPB opinion and subsequent Schrems II guidance require Transfer Impact Assessments (TIAs) for SCC-based transfers to countries where government access laws may undermine the SCCs' protections. India's lack of an adequacy decision and the DPDPA's government access provisions (Chapter VII) mean EU processors using Freshworks should conduct a TIA for the India transfer chain.

What Freshdesk Processes on Your Behalf

Freshdesk is a data processor under GDPR Article 4(8) when deployed by EU organisations for customer support. The categories of data processed depend on the customer's use case but routinely include:

Standard personal data (GDPR Art. 4):

• Customer identifiers: name, email, phone, account ID
• Support ticket content: free-text correspondence, attachments, screenshots
• Chat transcripts from Freshchat integration
• Call recordings from Freshcaller integration
• IP addresses, device fingerprints, browser user agents
• Time-zone and geolocation metadata

Elevated-risk data categories commonly appearing in helpdesk tickets:

• Health product complaints — customers reporting adverse reactions, medical device issues
• Financial hardship disclosures — billing dispute context, payment failure explanations
• Authentication credentials and session tokens — shared in account recovery contexts
• Disability accommodations — users requesting accessible alternatives
• Legal correspondence — support tickets from regulators, solicitors, or compliance officers

AI processing risk: Freshworks has invested heavily in AI features under the Freshworks Neo platform, including Freddy AI — an AI assistant that processes ticket content to suggest responses, classify issues, and summarise conversations. AI model training on customer support ticket data creates additional data-flow pathways, including potential transfer to US or India AI infrastructure, that require separate GDPR Article 28 documentation.

CLOUD Act Risk: US Government Access to Support Tickets

Under the CLOUD Act (18 U.S.C. § 2713), US providers — including Freshworks Inc. — "shall comply with the obligations of this chapter to preserve, backup, or disclose the contents of a wire or electronic communication and any record or other information pertaining to a customer or subscriber within such provider's possession, custody, or control, regardless of whether such communication, record, or other information is located within or outside of the United States."

This means a US federal court order or law enforcement request directed at Freshworks Inc. in San Mateo:

• Can compel disclosure of any support ticket data in Freshdesk
• Applies regardless of whether the data is stored on Freshworks' EU data-residency servers
• Does not require notification to the affected EU customer or EU supervisory authority
• Cannot be blocked by GDPR Article 48 objections in most practical cases

Freshworks CLOUD Act Challenge response: Like most US SaaS vendors, Freshworks' legal team may challenge unlawfully broad requests. The CLOUD Act bilateral agreement framework (18 U.S.C. § 2523) does not currently include a US-EU bilateral agreement — negotiations for a US-EU CLOUD Act executive agreement have not concluded. Without a bilateral agreement, there is no formal mechanism preventing US law enforcement access from conflicting with GDPR Article 48.

GDPR Article 28: Processor Obligations and Contract Requirements

Under GDPR Article 28(3), a data processing agreement with Freshdesk must specify:

• Processing subject-matter, duration, nature, and purpose
• Categories of personal data and data subjects
• Controller's obligations and rights
• Sub-processor chain (Freshworks uses AWS and other sub-processors)

Freshworks provides a standard DPA. EU organisations should verify:

1. The DPA covers the complete sub-processor list, including India engineering entities
2. SCCs are in place for transfers to India (Annexes I, II, III completed)
3. A Transfer Impact Assessment has been conducted for the India transfer chain
4. Freddy AI processing is addressed in a separate AI addendum or DPA supplement

Regulatory Enforcement Landscape

German DPA position: The German Federal Commissioner for Data Protection and Freedom of Information (BfDI) and state DPAs (particularly the Bavarian LDA and Hamburg DPA) have taken strong positions on CLOUD Act risk in US SaaS contracts. The BfDI's 2023 guidance on cloud services recommends assessing US law enforcement access risk as part of standard procurement.

French CNIL: CNIL's 2022 opinion on Google Analytics — ruling GA4 transfers illegal under GDPR — established the principle that EU-server claims do not neutralise CLOUD Act exposure. The same analysis applies to any US-incorporated SaaS vendor, including Freshworks.

Schrems II and EDPB guidance: The EDPB's "Recommendations 01/2020 on measures that supplement transfer tools" (updated 2021) require controllers to assess whether SCCs are "effective in practice" for a given transfer destination. For India transfers from Freshworks, this assessment must account for DPDPA government access provisions.

Freshdesk Features vs. EU-Native Alternatives

Freshdesk's core feature set includes:

• Multi-channel ticket management (email, chat, phone, social)
• Freddy AI for auto-classification and suggested responses
• Freshchat for live chat and messaging
• Freshcaller for integrated cloud telephony
• Reporting and analytics
• App marketplace with 1,000+ integrations

EU-native alternatives offer comparable functionality with different jurisdictional profiles:

Zammad — Berlin, Germany

Zammad GmbH is headquartered in Berlin and operates as a German private limited company. Zammad is open-source (AGPLv3 license) with a commercial SaaS option hosted on German infrastructure.

Jurisdictional profile:

• German GmbH — EU legal entity, German DPA (BfDI) jurisdiction
• No CLOUD Act exposure (no US parent)
• No India DPDPA transfer risk
• Data hosted on German servers (Hetzner / own infrastructure)
• Transparent codebase — open-source audit possible

Feature comparison to Freshdesk:

• Multi-channel: email, chat, phone, social ✓
• AI features: Zammad AI (OpenAI integration — note: requires separate API agreement)
• Integration ecosystem: smaller than Freshdesk's 1,000+ marketplace
• Self-hosted option: full data sovereignty possible
• Price: from €0 (self-hosted) to ~€15/agent/month (cloud)

Best for: organisations requiring full code transparency, self-hosted deployment, or strict German-jurisdiction data processing.

Crisp — Strasbourg, France

Crisp IM SAS is incorporated in Strasbourg, France — EU jurisdiction, French DPA (CNIL) authority.

Jurisdictional profile:

• French SAS — EU legal entity
• No CLOUD Act exposure
• CNIL oversight
• European data centers

Feature comparison:

• Strong live-chat and messaging focus
• Email support via shared inbox
• Chatbot builder
• Limited telephony compared to Freshdesk
• Price: from €0 to €95/workspace/month

Best for: companies prioritising live chat and messaging with EU-native compliance. Less feature-complete for complex enterprise ticketing.

LiveAgent — Bratislava, Slovakia

Quality Unit, s.r.o. operates LiveAgent from Bratislava, Slovakia — EU member state, Slovak DPA (ÚOOÚ) jurisdiction.

Jurisdictional profile:

• Slovak s.r.o. — EU legal entity
• No CLOUD Act exposure
• EU data centers (Slovakia, Germany)

Feature comparison:

• Omnichannel: email, chat, phone, social ✓
• Call centre features comparable to Freshcaller
• Gamification and agent productivity tools
• Price: from $9 to $49/agent/month (competitive with Freshdesk)
• Strong telephony integration

Best for: organisations needing Freshdesk-equivalent omnichannel features, including call centre capabilities, with EU jurisdiction.

HelpDesk by Text — Poland (Trusted by TeamViewer)

Text S.A. (formerly LiveChat Inc.) operates HelpDesk from Wrocław, Poland — EU jurisdiction, Polish DPA (UODO) authority. Text S.A. is listed on the Warsaw Stock Exchange.

Jurisdictional profile:

• Polish SA — EU legal entity, Warsaw Stock Exchange
• No CLOUD Act exposure
• EU data centers

Feature comparison:

• Ticket management with email-centric workflow
• LiveChat integration
• Strong API for custom integrations
• Price: from $29/agent/month

Best for: organisations already using LiveChat seeking a complementary EU-native helpdesk tool.

Migration Considerations

Switching from Freshdesk to an EU-native alternative involves several practical steps:

Data export: Freshdesk provides ticket data export in JSON/CSV format via the API (GET /api/v2/tickets). Export includes ticket metadata, conversations, and contacts. Attachments require separate download. Historical ticket export should be completed before account closure.

Agent re-onboarding: Most EU-native alternatives offer import tools for Freshdesk exports. Zammad, LiveAgent, and Crisp all provide migration guides or partner services.

Integration re-mapping: Freshdesk's 1,000+ marketplace integrations will need to be rebuilt on the new platform. Critical integrations (CRM sync, ecommerce, billing) should be identified and verified as available on the target platform before migration.

Sub-processor DPA review: On migration, the new platform's DPA becomes the operative processor agreement. Verify that the EU-native provider's sub-processor list does not introduce US or India transfer gaps through third-party services (payment processors, cloud infrastructure).

Summary: Freshdesk GDPR Risk Assessment

Freshdesk is a capable helpdesk platform that continues to win on price and feature completeness. However, EU organisations processing personal data — particularly those in regulated industries such as healthcare, finance, or legal services — face a dual CLOUD Act and India DPDPA exposure that requires explicit Transfer Impact Assessment documentation and active DPA management.

For organisations where GDPR Article 9 special-category data (health, financial, disability information) routinely appears in support tickets, the compellability risk of US law enforcement access to that data warrants serious consideration of EU-native alternatives. Zammad, Crisp, and LiveAgent eliminate both the CLOUD Act exposure and the India transfer gap by processing data exclusively within EU jurisdictions.

The Freshworks story — Indian-founded, Delaware-incorporated, NASDAQ-listed — is a model for global SaaS scaling. For EU privacy compliance purposes, however, the relevant chapter is the Delaware incorporation, not the Chennai founding.