Data Loss Prevention for Zendesk: DLP for Ticketing Systems

Zendesk DLP is a set of controls that detect sensitive data inside Zendesk and act on it automatically. It covers the places data actually lands: ticket comments, chat messages, email replies, and file attachments.

A Zendesk DLP tool does three jobs. It runs sensitive data discovery on the tickets you already have. It checks each finding against a DLP policy. And it applies DLP remediation, such as redaction or deletion, when new data arrives.

The data usually falls into four groups:

• Card and bank data: card numbers, statements, and account details typed into chat.
• Personal data: Social Security numbers, passport scans, driver's licenses, and dates of birth.
• Health data: diagnoses, insurance cards, and medical forms sent to a patient support team.
• Secrets: API keys, passwords, and tokens pasted into internal notes during an escalation.

✨ Why Zendesk Needs DLP

Zendesk is built to keep a complete record of every customer conversation. That history is the point of the product; it is also the risk.

A customer pastes a card number into chat to speed up a refund. Another attaches a passport photo to prove their identity. An agent copies a ticket into Slack to escalate it. None of this looks like an attack, yet the data now sits in several systems for years.

Recent incidents show what is at stake. In February 2026, Hims & Hers disclosed that support tickets were stolen from its customer service platform, with names and contact details among the data involved. In 2025, Discord disclosed a breach of a third-party support system that exposed ID images.

The lesson is broader than any one vendor. Access controls decide who can open a ticket. DLP decides what is inside the ticket when they do.

AI raises the stakes. Assistants such as Claude and ChatGPT can connect to Zendesk through the Model Context Protocol (MCP), the standard that lets an assistant read data from another app. Zendesk announced its own MCP server in May 2026, and third-party servers already exist. Whatever the assistant reads may be sent to the AI provider, including a card number from an old ticket.

Does Zendesk Have Native DLP?

Zendesk has no complete DLP product, but it does have native data protection controls. Every team should turn on the ones available to them.

Included in many plans:

• Manual redaction of ticket content in the Zendesk Agent Workspace.
• Automatic credit card redaction in comments and custom fields, on Professional plans and above.
• Private attachments, so a file link requires a Zendesk sign-in.
• Triggers you can edit to keep ticket text out of email notifications.

Added by the paid Advanced Data Privacy and Protection (ADPP) add-on:

• Redaction suggestions that highlight common PII in ticket comments.
• Automatic comment redaction through ticket triggers.
• PII suggestions in PDF attachments, added in April 2026.
• Custom suggestions based on regular expressions, added in August 2026.
• Customer-managed encryption keys and more flexible deletion schedules.

Those controls have clear edges:

• File coverage is narrow. Attachment suggestions support PDFs only. Photos, screenshots, and spreadsheets are not scanned.
• Attachment redaction still needs a person. An agent has to act on each PDF suggestion, and a busy agent can miss one.
• Protection stops at Zendesk. Copies in Slack, Jira, laptops, and AI tools stay untouched.

Native redaction cleans the ticket; DLP also covers where the data goes next. For the mechanics, read Zendesk redaction. For a direct comparison, read Zendesk ADPP alternative. Card-specific rules are covered in is Zendesk PCI compliant.

✨ How Zendesk Redaction Works With Strac

Strac connects to Zendesk through an approved app, with nothing to install on agent laptops. Each new comment or attachment then follows the same path:

1. Strac inspects it. Detectors check the text and read inside PDFs, images, screenshots, and Office files with optical character recognition (OCR).
2. Your policy decides the action. You choose which sensitive data elements matter and what happens to each one.
3. The ticket is cleaned in place. The sensitive value is removed from the comment or file, and the conversation stays readable.
4. The original moves to the vault. Authorized people can open it from the Strac document vault with multi-factor authentication.
5. The action is logged. Your team gets an alert and an audit record of what was found and what changed.

You can also delay redaction until a ticket closes or until a set number of days has passed, so agents can finish the work first.

A redacted ticket still solves the customer's problem; it just cannot leak the card number that came with it.

🎥 Strac: Zendesk DLP for Tickets, Attachments & AI Agents

Strac Zendesk DLP works with the Zendesk Team, Growth, Professional, and Enterprise suites. It scans new tickets in real time and runs historical scans across old comments and attachments, so years of stored data get cleaned up too.

Strac detects PII, PHI, card data, bank details, and secrets, and you can add your own detectors and sensitivity settings. Ready-made policy templates cover HIPAA, PCI DSS, SOC 2, ISO 27001, and GDPR.

Strac remediates each finding in four ways:

• Redact / mask. Strac removes sensitive values from comments and attachments. See data masking and PCI DSS PAN masking for how card numbers are handled.
• Delete. Strac permanently removes comments and files that hold high-risk data.
• Alert. Strac notifies the right people when it finds sensitive data, so your team can respond.
• Vault. Originals move to a secure vault that only authorized people can open.

The same protection follows Zendesk data to AI assistants. Strac Zendesk MCP DLP sits between the assistant and Zendesk and redacts sensitive data before the AI model receives it. It can also block risky actions or require approval, and it logs every request. Read MCP DLP for the full approach and AI DLP for what agents paste into AI tools by hand.

Zendesk data rarely stays in Zendesk, so the same platform covers the places it travels:

• Other support tools: Intercom DLP, Salesforce DLP, Zoho Desk DLP, and HubSpot DLP.
• Escalation paths: Slack DLP, Jira DLP, Gmail DLP, and Office 365 DLP.
• Files and devices: Google Drive DLP, Box DLP, and endpoint DLP for downloaded attachments.
• Browsers and AI tools: Browser DLP and ChatGPT DLP.

DSPM shows where sensitive data already sits across those apps. For a wider view of the support stack, read customer support DLP or the customer support case study.

Finding the card number tells you there is a problem; removing it is what closes the risk.

Related reading:

• Zendesk MCP server
• Zendesk ADPP alternative
• How to prevent data leaks from Zendesk tickets

How to Choose a Zendesk DLP Tool

The best test is a real one: run the tool against a sample of your own tickets, including messy attachments. Then check these points:

• Attachment depth. Does it read photos, scanned PDFs, and spreadsheets, or only ticket text?
• Remediation. Does it remove the data automatically, or only send an alert?
• Historical scanning. Can it clean up years of closed tickets as well as new ones?
• Original data handling. Can authorized people recover a redacted value when a case truly needs it? Zendesk's native redaction is permanent.
• Coverage beyond Zendesk. Does the same policy apply in Slack, on laptops, and in AI tools?
• Audit evidence. Can you export a clear record for HIPAA, PCI DSS, SOC 2, and GDPR reviews?

Should You Build Your Own Zendesk DLP?

For most teams, no. A homegrown script can match a clean card number. It is much harder to read text inside images, keep detectors accurate, redact without breaking the ticket, and produce evidence for auditors. Someone then has to maintain all of it as Zendesk, your data, and the rules change.

Zendesk DLP Checklist

• ☐ Limit admin roles and review which agents can see which groups.
• ☐ Turn on private attachments and remove ticket text from email notifications.
• ☐ Set deletion schedules, and apply data minimization to what you keep.
• ☐ Review connected apps and remove any that do not need ticket access.
• ☐ Run a historical scan of tickets and attachments, then clean up what it finds.
• ☐ Turn on real-time redaction for card numbers, ID numbers, and health data.
• ☐ Put MCP DLP between AI assistants and Zendesk before rolling them out.
• ☐ Route alerts to your team and plan your DLP incident response.

The Bottom Line

Customers will keep sending sensitive data to support, and tickets will keep traveling to other apps and AI tools. Access controls fail eventually; the data layer is the backstop. Redact sensitive data in every ticket, attachment, and assistant request, and a stolen login exposes far less.

‍Book a demo to see Strac scan and protect your Zendesk tickets.

🌶️ Spicy FAQs for Zendesk DLP

Is Zendesk DLP the same as Zendesk redaction?

No. Redaction is one action. Zendesk DLP also finds sensitive data, applies a policy, logs the result, and can follow the same data into other apps and AI tools. Read Zendesk redaction for the mechanics.

Does Strac replace Zendesk's ADPP add-on?

For redaction, it can. Strac automatically handles comments and common attachments, including images, and also covers other apps. ADPP includes other features, such as customer-managed encryption keys, so check which of those you need before deciding.

Will redaction slow down support agents?

No. Strac removes the sensitive value and leaves the rest of the ticket intact. Delayed redaction lets agents finish the case first, and authorized people can open the original in the vault when they truly need it.

Can redaction take back a reply that was already sent?

No. Redaction cleans the copy stored in Zendesk, not an email already sitting in a customer's inbox. That is why the data layer matters: removing data early limits how much can spread, and agents still need care with outbound replies.

Is Zendesk compliant with HIPAA and PCI DSS on its own?

Not automatically. Compliance depends on your plan, your configuration, and what agents and customers put in tickets. Read is Zendesk PCI compliant, then see HIPAA DLP and the SaaS DLP pillar.