Security & Compliance

Getting intermittent hard bounces from Outlook/Microsoft recipients:```550 5.7.515 Access denied, sending domain HELP.HUEL.COM doesn't meet the required authentication level.SPF=Fail, DKIM=Pass, DMARC=Pass``` Setup: domain SPF managed via Sendmarc, mail sent through Intercom → Sparkpost EU. DMARC passes via DKIM alignment, so by DMARC's own rules this should be fine — but Microsoft is rejecting on SPF specifically.I’m being told by Intercom that this is just an accepted loss with not being able to respond to these customers.  Anyone else experience this?  

Our subdomain managed by intercom was flagged as ‘Unsafe Implementation Of Subresource Integrity’ issue."Unsafe Implementation of Subresource Integrity" usually comes from a scanner flagging that you're loading external scripts or stylesheets (typically from a CDN or third-party service) either without an integrity attribute, with a weak hash, or with integrity present but missing crossorigin. Subresource Integrity (SRI) lets the browser verify that a fetched file hasn't been tampered with by comparing it against a cryptographic hash you specify.Can you do something to mitigate this? Like<script  src="https://cdn.example.com/library@1.2.3/file.min.js"  integrity="sha384-<hash>"  crossorigin="anonymous"></script> 

Hello,We're seeing localized email headers displayed to customers in email conversations.For example, the quoted conversation history contains russian language:От: Отправлено: Кому: Тема:and timestamps such as:(UTC+07:00) TomskOur workspace language is set to English, and we'd like all customer-facing communication to appear in English.Could you please clarify:Where these localized headers are coming from? Whether there is a way to force them to appear in English? Whether there is a setting to prevent timezone names such as "Tomsk" from being shown?I've attached screenshots for reference.Thank you. 

Our need is to have agents always taking chats/calls at all times, without ability for them to switch away from one or the other.  A setting that prevents agents from modifying this is desirable.

DISREGARD - MEANT TO SUBMIT THIS AS A FEATURE REQUEST.

I am using intercom iOS sdk using pod install and every time I launch intercom screen I got this Tried to update user but there was a network error (401) - Failed Identity Verification check error. Earlier it was working now it is not working. Same user email using in intercom of another iOS application then it is working. 

Has anyone successfully managed to setup access for customers to the ticket portal without using JWT authentication? We’re not a SaaS business, and our customers run the software on premises, often behind firewalls without access to the internet, so integrating intercom into the platform is a non starter. I’m looking at launching with Email & Slack channels, but have hit a blocker with the ticket portal feature - ideally I do not want to have to build a customer interface to surface this to customers. 

Hello,Based on the documentation (https://www.intercom.com/help/en/articles/3894-using-intercom-with-content-security-policy), it appears that both unsafe-inline and unsafe-eval need to be added to our Content Security Policy in order for the JavaScript widget to function.From a security perspective, this raises serious concerns, as it increases the attack surface. Our reporting endpoint shows that unsafe-inline isn’t actually required by your code, but unsafe-eval is being triggered in the vendors-app-modern.js file at the following line:var mod = eval("quire".replace(/^/, "re"))(moduleName);Is there any way to eliminate this eval call? If not, we may need to reconsider our use of Intercom due to these security implications.Best regards,Salim

We are starting to sell to a number of customers in the FedRAMP space. Intercom is not currently in the FedRAMP marketplace. Any chance that this will change soon? I really don’t want to switch to a compliant platform, but I know that a direct competitor has a gov cloud version that we could use.  

I connected a new feature that became available for the account. However, I cannot disable it; there was no warning about a large payment amount, and I thought there were limits on the number of chats for analytics, but it turns out there is no limit and funds are just being charged continuously. I have already created 4 requests in the chat, but in 4 days, none have received a response or connected me with a specialist.

Hi everyone,I'm trying to implement authentication for the Help Center and ticket portal using JWT, but I'm having trouble finding documentation about what happens after generating the JWT.I already have the JWT generated on my backend, but I can't find clear docs explaining: How to use that JWT to actually log the user into the Help Center How to authenticate them for the ticket/request portal Whether there's a specific endpoint, redirect flow, or client-side method required after obtaining the JWT I also tried following the approach discussed in this community thread, but I couldn't get it to work in my implementation:https://community.intercom.com/settings-security-permissions-22/dynamic-help-center-login-link-11313?tid=11313&fid=22 Most documentation I found explains how to generate the JWT, but not how to complete the login flow with it.Does anyone have: Documentation Example implementations Articles or guides I tried thison how to finish the login process once the JWT

Hello Team, Can you take a look “Why changes in workflow and other settings (banners) won't show on Change Log Section?”Snippets = is okGuidance = is okuser settings = is okWorkflow = NoOutbound banners = NoReally important for us. Easier to check and do audits this that way. 

I’ve tried everything in the doc and through other posts, but  just can’t seem to make this work. The message just doesn’t display at the bottom of the page.

There is a property that the SDK adds to requests to Intercom. It is called anonymous_session . It appears to keep the API calls to Intercom working beyond the JWT expiry. :Why does this keep authentication alive? Is there a way we can disable it to have more control over the amount of time the API is accessible.

We have users worldwide and I have agents in India, UK and Canada.What are the best practices for working with voice channels from countries where we have no office?Example: We have no office in Mexico, it’s impossible to get a local number and have them call into the US or Canada line

Hello,I work on a platform and they are using intercom for their live support chat. I am using for several months and it worked perfectly. But now for over a week, it keeps loading here:  I’ve talked with them via email and even they’re shocked. They don’t know what’s wrong, neither do I. I’ve cleared cache, relogged in, and changed browser, nothing worked. Can anybody please help me out in this regard? Thanks in advance!

I am facing problems while trying to create an account on intercom, the error 403 forbidden appears, it shows that my workspace is suspended, but I have respected all the policies.

Hi!We are not using Fin anywhere in our product and are not currently interested in implementing it. It’s never been integrated into a workflow and I have never manually turned it on. From our customer’s help chat perspective, they are seeing the following header on the chatbox: It happens when the agent they are speaking to goes idle or if the user clicks on a conversation that was previously closed. Why does this show up? I need to remove this. Our product’s customers have no idea what “Fin” is. I also don’t know what “The team can also help” means.Any help would be so appreciated! Thanks

GET https://js.intercomcdn.com/vendor-modern.1ffdfa4a.js net::ERR_SSL_PROTOCOL_ERROR GET https://js.intercomcdn.com/frame-modern.f3182eef.js net::ERR_SSL_PROTOCOL_ERRORPlease let us know if you need more details

Hi, We are looking to make our Help Center articles mostly limited to just users. We have SSO setup with Entra/Azure and that works fine for access to the backend. Is there a way to leverage Microsoft for access to the Help Center articles so only users that are part of that group can access the articles as well?Thank you!  

I’m having an issue with the workflow in our ticket queue when closing a ticket. Normally when a ticket is closed the next ticket in the queue is automatically selected. For the last couple of days this has not been happening. For the most part it is reverting to the most recent ticket received in the queue, but sometimes it jumps to a random ticket somewehere else in the queue. I seem to be the only member of our team experiencing this so I think I have inadvertantly changed a setting somewhere but cannot find anything about this in the Settings or the Help section.

Hi Intercom Community,We are a returning customer (we was using Intercom for many years until end of 2024 with US data hosting) and want to come back but with EU hosting to make it complaint. I’m hoping to get some help moving the process forward as we seem to be stuck.Our goal is simple: we want to pay for and activate the Intercom Advanced plan with EU data residency. Another words: 😅 To make it as easy as possible, here are all the details: Plan: We need 3 seats on the Advanced plan. Hosting: Data residency in the European Union is a mandatory requirement for us. Commitment: We are ready to pay immediately. We understand an annual commitment is required, and that's perfectly fine. We can even pay for 2 years upfront if it helps accelerate the activation. Context: We were long-time Intercom users who churned in late 2024. We've decided to come back and are fully aware of the product and its capabilities (including the limitations of the EU hosting add-ons). Urgency: We are f

Looking at the implementation of intercom for IOS, the creator seems to leave the API key in the front end. Does this mean that this API key is fine if exposed to the end user? I don’t seem to see another way to obscure it, as keeping the key on the backend doesn’t seem like an option if I want to use intercom’s package.import Intercomlet INTERCOM_APP_ID = "<#YOUR APP ID#>"let INTERCOM_API_KEY = "<#YOUR API KEY#>"class SceneDelegate: UIResponder, UIWindowSceneDelegate { 

I already added all the CNAME and TXT record to my DNS server. However, the outbound.intercom is the only one did not get authenticated and i have already wait more than 48 hours for it.It is because i am in the dev environment? 

Unable to complete payment for enable ( add team member ) module on my workspace, getting something when wrong. i have attached the activity status change with time log and right now getting alert watning screens shot as well for better understanding. looking forward to kind support, as blocked for now to perform / test features testing into our system. Thanks in advance for your kind support.