Best AI Agent Security Software for Intercom Fin and Fin AI Agent Data Connectors

The best AI agent security software for Intercom Fin depends on what your connectors can do. If Fin only answers from your help center or reads order status, Fin's own controls (JWT Messenger security, one-time passcodes and the connector Security tab) are enough, and you should buy nothing. If Fin issues refunds, credits or account changes through APIs your support team does not own, you need limits that sit outside Fin, either written into those APIs or enforced by a control in front of them.

We sell one of those controls. We say "you may not need us" first on purpose, because for most teams running Fin on knowledge content alone it is the correct answer.

Why Fin buyers are reviewing agent security now

Two things changed this year. Fin moved from answering questions to taking actions: data connectors let it call your APIs during a conversation, and Procedures chain those calls into multi-step flows that look up an order, offer a refund and complete it. And the company changed hands. Intercom renamed itself Fin in May 2026, and Salesforce completed its acquisition on September 10, 2026. Salesforce says Fin keeps working with the helpdesks customers already use, but any change of ownership sends procurement back to the trust center, and that review is when someone asks what Fin is allowed to do on its own.

Fin's documentation is candid about the answer. Its guide to designing APIs for data connectors says "Your API should enforce application-specific limits, such as capping refunds at a maximum amount per day," and "Ensure your API is idempotent, as Fin may submit the same refund request multiple times." In other words, the limits are yours. The options below are the different ways to own them.

The five options compared

Three of the five cost nothing beyond time you may already be spending. That is deliberate, and the order of the table is the order we would try them in.

Start with Fin's own controls

Start here, because they are good and already paid for. Fin holds SOC 2 Type II, ISO 27001 and ISO 42001, and Fin AI Agent carries an AIUC-1 certification. Messenger Security with JWTs is the control Fin itself calls "the most important security control to set up for your integration", and without customer authentication Fin warns that "malicious actors could impersonate your users and access their data." Messenger authentication does not cover Leads or other channels, so require a one-time passcode there before any connector runs. Then clear the Security tab on every connector, which flags unverified customer data attributes, Fin-collected input, workflows that could expose sensitive data and request headers. Our Intercom Fin AI agent security page lists each native control and where it stops in more detail.

Build limits inside your own APIs

This is the option Fin recommends, and if you own the billing and order APIs it is the cheapest durable fix. Every write endpoint gets an ownership check, so a customer cannot "cancel someone else's order by knowing the order ID", a cap per customer and per day, and an idempotency key so a retry cannot pay out twice. The weakness is organizational. Support teams usually do not own those APIs, and the engineers who do have their own roadmap. If you can get this work scheduled this quarter, do it, and you may need nothing else.

Use Procedure handoffs for high-value refunds

A Procedure can be written to hand a refund above a set amount to a teammate rather than call the connector. It is a useful policy layer and it keeps high-value refunds with people. Treat it as a default, not a guarantee, because the decision to follow the instruction is still made by the model reading the conversation. Pair it with a hard cap in the API so the instruction and the limit say the same thing.

Route connector traffic through a general API gateway

If your platform team already runs an API gateway, put Fin's connector traffic through it with its own credential and rate limit. That catches runaway retries and gives you a request log outside Fin. It will not read the body of a refund call or hold one specific request for approval, and it treats every caller the same way, which is why it works best as a floor under the other options.

Add an agent action control layer

This is where we fit, and only for the last two situations in the table below. AgentShield sits in front of the endpoints Fin's write connectors call and applies per-agent tool and data permissions to each call. A rule can pass refunds under your threshold, hold one above it, hold any change on an account that does not match the verified customer, and hold a second identical request inside a short window. Held calls return a pending status your Procedure can hand off on, a named teammate approves or denies, and every decision lands in one record. The mechanics are the same ones we describe in approval gates for AI agents.

A tighter refund policy has a side effect worth planning for. Some customers who are refused by Fin go straight to their card issuer instead, so if disputes are already a cost line for you, put chargeback prevention software on the same review as your refund rules, so one team sees both numbers.

Which option fits your Fin deployment

What does Intercom Fin security cost?

Fin itself lists 0.99 USD per outcome, with a 50 outcome monthly minimum on other helpdesks, and it charges one outcome per conversation even when Fin takes several actions. Fin native controls and Procedure handoffs add nothing to that bill. API limits cost engineering time, usually a few days per write endpoint for checks, caps and idempotency. A general API gateway runs on infrastructure you probably already pay for. Our own plans are on the pricing page, so you can compare real numbers without a sales call. If you also run Zendesk, the Zendesk AI agents security page covers the same decision there.