In 2023, Intercom launched Fin, an AI agent that resolves support conversations and bills $0.99 for every conversation it closes without human involvement. Few customers ever check what happens technically behind that per-resolution price: a message a shopper types into a chat widget embedded on an online store travels to Intercom's servers and, from there, gets forwarded to OpenAI's models in the United States to generate the reply. It doesn't matter whether the company that installed the widget is based in Munich, Madrid or Amsterdam — the content of that support conversation, which often includes an order number, a shipping address, and sometimes partial payment details, crosses the Atlantic and ultimately falls under the 2018 US CLOUD Act.
This comparison doesn't ask which platform closes tickets faster. It asks something product reviews routinely skip: where the company was born, where the end user's data actually lives, and how much jurisdictional control a European customer keeps when it installs Intercom or Chatwoot on its website.
Why democratic origin matters in customer support
A support conversation is not a trivial piece of data. A single ticket can contain a customer's full name, shipping address, the last four digits of a card, screenshots of invoices, and — in sectors like healthcare or banking — far more sensitive information still. The GDPR treats most of that content as personal data, and Articles 44 onward explicitly restrict transferring it outside the European Economic Area unless a recognised safeguard mechanism is in place. Choosing a support vendor isn't only a product decision — it's a compliance decision with real legal consequences for the company that signs the contract.
Intercom: from Dublin to San Francisco, with AI that leaves the EU
Intercom was founded in 2011 in Dublin by Eoghan McCabe, Des Traynor, Ciaran Lee and David Barrett, four former colleagues from the consultancy Contrast (formerly Exoftware). The company went through Y Combinator in Silicon Valley that same year and soon moved its primary operating base to San Francisco, while keeping — and still keeping today — a substantial engineering and operations hub in Dublin. Ireland scores 8.28 on the EIU Democracy Index, a full democracy with data protection standards that have made it the reference European base for tech giants for over a decade. Intercom offers EU customers the option to host account data in its EU region, with infrastructure in Dublin and Frankfurt running on AWS.
Intercom became one of the most highly valued SaaS startups of its generation: it raised over $240 million across funding rounds and reached a valuation above $1.275 billion in 2018, backed by investors including Bessemer Venture Partners, Index Ventures and Kleiner Perkins. That scale let it build a product spanning several distinct modules — inbox, product tours, surveys, and a knowledge base among them — now used by more than 25,000 companies worldwide, from startups to Fortune 500 firms.
The blind spot appears with Fin, the generative AI product Intercom launched in 2023. Fin doesn't run on a model Intercom trained itself — it relies on OpenAI's GPT models, a company headquartered in San Francisco and subject to the US surveillance legal framework and the CLOUD Act. Even when a European customer enables EU data hosting for the rest of the platform, the content of every conversation routed through Fin is sent to OpenAI's infrastructure to generate the reply. Intercom documents this architecture in its subprocessor policy, but many customers who flip on Fin for convenience never read that clause before turning it on for every support conversation they handle.
Chatwoot: open source, born in India, hostable wherever you decide
Chatwoot was founded in 2017 in Bangalore, India, by Pranav Raj T S and Sojan Jose, later backed by Y Combinator. Unlike Intercom, Chatwoot ships under the open-source MIT license: any company can download the full source code, audit it, modify it, and deploy it on a server of its own choosing, with no dependency on the founding company's infrastructure. India scores approximately 7.04 on recent editions of the EIU Democracy Index — above the 6.0 threshold Democratic Market applies, though classified as a flawed democracy due to weaknesses in civil liberties and government functioning.
Chatwoot has taken the opposite funding path from Intercom's: staying lean (seed rounds and a modest Series A, nowhere near Intercom's nine-figure numbers) and betting on organic, community-driven growth instead. Its GitHub repository has crossed 20,000 stars, with hundreds of external contributors adding integrations, translations and security fixes without relying exclusively on the founding team. That open codebase is also why companies with particularly strict compliance requirements — public-sector contractors, banks, healthcare providers — can literally audit every line before deciding where and how to deploy it.
Chatwoot's real democratic advantage isn't just its founding team's home country — it's the jurisdictional freedom it hands to the customer. A European company deploying Chatwoot on its own server can choose to host it in a data center in Iceland (9.45 EIU, running on the cleanest energy grid in Europe), in Switzerland (9.14, with the Swiss Federal Data Protection Act layered on top of GDPR), or in Germany (8.80), guaranteeing that no support conversation data ever leaves the legal framework the company itself picked. Chatwoot also lets customers connect self-hosted language models through tools like Ollama, avoiding any conversation data being sent to a third party like OpenAI at all, if that's the choice the customer makes.
Feature-by-feature: capability, price, and democratic profile
On raw functionality, Intercom still leads: its product includes product tours, a shared inbox with advanced automation, behavior-based user segmentation, and a polished interface that has set the industry benchmark for years. The price reflects that: paid plans start around $39 per seat per month and climb quickly once AI features like Fin are switched on, billed per resolution. Chatwoot, self-hosted, is free aside from the cost of the server it runs on; its managed cloud version starts at roughly $19 per agent per month. The interface is plainer and some native integrations trail Intercom's, but it covers the essential flows — shared inbox, rule-based chatbots, and now optional AI-generated summaries.
The democratic risk isn't the country — it's the subprocessor chain
One nuance a shallow comparison would miss: neither Ireland nor India scores below the risk threshold Democratic Market applies. The real democratic risk in this category doesn't live in the company's legal seat — it lives in the chain of subprocessors handling the actual content of conversations. Intercom, despite being founded in and still engineering out of a full democracy, introduces a structural dependency on a US subprocessor — OpenAI — for its most heavily marketed AI feature. Chatwoot, thanks to its open-source nature, shifts that decision back to the customer: you can keep the entire chain inside the EU, or even run the language model on your own server with zero third-party calls.
EU legislation applicable to this category in 2026
The EU AI Act, in force since August 2024, begins applying transparency obligations in 2026 to AI systems that interact directly with people, including support chatbots: end users must be able to know they're talking to an automated system, unless that's already obvious from context. Layered on top is the 2023 EU-US Data Privacy Framework, which legally enables sending personal data to certified US providers like OpenAI, but which has already been challenged before the Court of Justice of the EU on the same grounds that struck down its two predecessors, Safe Harbor and Privacy Shield. Any European company relying on Fin should have a contingency plan if that framework falls for a third time.
Beyond the AI Act, GDPR still requires a transfer impact assessment every time a company activates a subprocessor located outside the European Economic Area. Several national data protection authorities, including Austria's and France's CNIL, have issued rulings since 2022 questioning the use of US AI providers for European citizens' data, even under the new privacy framework. A company that enables Fin without documenting that assessment is exposed to penalties if a data protection authority decides to audit it.
How Democratic Market evaluates this category
For software-as-a-service platforms, Democratic Market doesn't apply the same country-of-manufacture test it uses for physical products. Instead, we evaluate three layers: the country where the parent company is legally incorporated and its EIU score, the region where data is hosted by default and whether an EU hosting option exists, and the full chain of AI subprocessors disclosed in the privacy policy, with particular attention to whether the customer can disable them or swap them for self-hosted alternatives.
A practical buying guide
If your company handles sensitive customer data — health, finance, data belonging to minors — and you want full jurisdictional control, self-hosted Chatwoot on a European server paired with a local language model is the option with the least exposure. If you prioritize fast implementation and polished features and aren't concerned about AI conversations passing through US servers, Intercom with EU data hosting enabled (and Fin turned off or limited to conversations without sensitive data) is a reasonable alternative. Always check the vendor's subprocessor page, not just the generic marketing security page.
A minimum checklist before deciding: check whether the provider offers an EU hosting region by default or as a paid add-on; request the signed Data Processing Agreement and subprocessor list; verify whether generative AI features can be selectively disabled by conversation type; and confirm which security certifications the provider holds, such as ISO 27001 or SOC 2 Type II, both present at Intercom and absent by design from an open-source project like Chatwoot, which shifts that certification responsibility onto whoever self-hosts it.
Compliance in practice: DPAs and subprocessors
Before signing with either platform, ask the provider for its Data Processing Agreement under GDPR Article 28 and the current subprocessor list, usually linked at the bottom of that same legal page. Intercom publishes that list and notifies customers subscribed to subprocessor alerts ahead of changes; Chatwoot, being self-hosted, removes most of that chain because the customer itself acts as sole controller on its own server, unless it chooses Chatwoot Cloud, the managed version, which reintroduces the subprocessor figure.
Intercom states that Fin resolves, on average, around 50% of support queries without human intervention for customers who enable it fully, a figure the company has used as a central sales argument since 2024. That automation share is also, from Democratic Market's perspective, the minimum share of conversations passing through OpenAI's infrastructure for every customer that enables Fin without additional restrictions.
The switching cost between Intercom and Chatwoot also deserves a mention: Intercom lets you export conversations and history via API, but there's no official migration tool toward Chatwoot, so a full transfer of historical support conversations usually requires custom development work. Democratic Market recommends that companies evaluating this switch factor in that development cost as part of the decision, rather than comparing the two platforms' monthly fees alone.
Looking toward 2027, the European Commission is evaluating whether to extend the AI Act's data residency requirements to third-country infrastructure providers, which would force companies like Intercom to document their AI subprocessor chain in far greater detail, or to offer, for the first time, language models hosted entirely on European territory as an alternative to Fin. Until that proposal takes concrete shape, the responsibility for verifying where each conversation is processed still falls on the company buying the software, not on the vendor.
Conclusion: what Democratic Market recommends
Neither platform was founded in a country with a weak democracy, so both clear Democratic Market's baseline filter. The recommendation comes down to each company's risk appetite: those who want full data sovereignty should look at self-hosted Chatwoot; those who prioritize a polished product and accept OpenAI as a subprocessor should, at minimum, insist that Intercom keeps EU data hosting enabled for everything that doesn't pass through Fin.
This article was originally published at Democratic Market. Read the full version with additional analysis on our site.
