Intercom Fin AI Agent Security for Data Connectors, Procedures and Refund Actions
Fin no longer only answers questions. Through data connectors and Procedures it cancels subscriptions, updates orders and issues refunds by calling your APIs, and since September 2026 it belongs to Salesforce. Fin ships solid security for the conversation. This page shows what it covers, the limits its own documentation hands back to your API, and when a second control is worth paying for.
Direct answer
Intercom Fin AI agent security covers the conversation well: SOC 2 Type II, ISO 27001 and ISO 42001, an AIUC-1 certification for Fin AI Agent, JWT Messenger security, one-time passcodes, a Security tab that checks each connector before launch, and encrypted connector tokens. What Fin does not do is decide whether a specific write call should happen. Its documentation says refund caps, per-customer authorization and duplicate-request handling belong in your API, and no staff approval step is documented for a connector call.
Try it live
Watch AgentShield block an attack in real time.
Pick a scenario and drive the inspection lane yourself. No signup needed.
Run a request
Runs the live engine on your text. Nothing is stored, no account needed.
Inspection lane
INSPECTINGPolicy trace
High-risk action held for approval
Audit trail
- § · → → →
The risk
A US subscription business connects Fin to its billing API so customers can get a refund on a duplicate charge without waiting for a person. The connector works in testing and goes live through a Procedure. Two weeks later a customer writing from the email channel, where Messenger authentication does not apply, gives an order number that belongs to someone else, and the API accepts it because the connector sends the order ID and nothing checks who owns it. The next morning the team finds three refunds for one order, because Fin retried a slow request and the endpoint was not idempotent. Every one of these failures sits in a place Fin's own documentation told the team to handle on the API side.
How AgentShield handles it
Use Fin's controls first. Turn on Messenger Security with JWTs, require a one-time passcode before any connector runs on a channel without login, clear every flag on the Security tab, roll connectors out with audience rules, and read the connector logs. Then point the write connectors that move money or change accounts at an AgentShield gateway endpoint in front of your API, so rules can check the arguments of each call, a refund above your threshold or on an account the customer does not own waits for a named teammate, repeated identical requests are held, and every allowed and denied action lands in one record.
The controls
The controls that secure which Fin data connector calls run and which wait for a named teammate.
What Intercom Fin secures natively
Fin is one of the better documented AI agents on the market when it comes to security, and most of what it ships protects the conversation itself. These controls come from Fin's help center and trust pages, read in October 2026. Fin publishes its compliance documents for self-serve download at trust.intercom.com, which saves a procurement cycle.
| Fin control | What it does | Where it stops |
|---|---|---|
| Certifications | SOC 2 Type II, ISO 27001, ISO 27701, ISO 27018 and ISO 42001, a HIPAA attestation with business associate agreements available, and an AIUC-1 certification for Fin AI Agent | Certifies Fin's own controls. It says nothing about what your connectors are allowed to do |
| Messenger Security with JWTs | Signs the user's identity so data "is only exposed to verified Users". Fin calls securing the Messenger "the most important security control to set up for your integration" | For Leads and other channels, the docs say "Messenger authentication doesn't apply" |
| One-time passcodes | Adds an email verification step before a connector runs or Fin exposes customer data | Proves the person controls an inbox, not that they own the order ID they typed |
| Security tab checks | Runs built-in checks before a connector goes live, covering unverified customer data attributes, Fin-collected input, workflows that could expose sensitive data and request headers | A pre-launch review. It does not evaluate each live call |
| Token and data handling | Connector tokens and request configurations are encrypted at rest, requests are sent from Fin's backend rather than the browser, and card-like numbers are masked to the last four digits | Fin notes that third-party data is not validated and that a connector "may overwrite data you've stored in Intercom" |
| Audience rules and logs | Lets you launch a connector for a subset of users, then read connector logs and connector activity in the inbox | Records what happened. It does not stop a call |
Creating or editing a connector also needs the "Can access developer hub" permission, so not every teammate can wire Fin to a new API. That is a sensible default and worth checking in your workspace role settings.
What Fin leaves to your API, in its own words
The most useful security document Fin publishes is its guide to designing APIs for data connectors, because it is unusually direct about where Fin's responsibility ends. These are the lines a security reviewer should read before approving any write connector.
| Topic | What Fin's documentation says | What that means for you |
|---|---|---|
| Spending limits | "Your API should enforce application-specific limits, such as capping refunds at a maximum amount per day." | Fin has no documented refund cap. Any limit is code you write and maintain |
| Ownership checks | Users should not be able to "cancel someone else's order by knowing the order ID", and this logic is not handled within Intercom | Every write endpoint needs its own check that the record belongs to the verified customer |
| Duplicate requests | "Ensure your API is idempotent, as Fin may submit the same refund request multiple times." | Without idempotency keys, a retry can pay out twice |
| Data minimization | "Ideally, the API should only return the data necessary for your Task/Workflow." | Broad endpoints that return a whole customer record hand Fin more than it needs |
| Liability | Intercom "will not and cannot accept any responsibility or liability for data leaked" through poor authentication or identification practices, and recommends a risk assessment | The risk assessment is yours, and it should name each write connector |
| Testing | Testing a POST, PUT or DELETE call performs the action, and "testing a DELETE call on a user will actually delete them" | Test against a staging API, never production |
This is honest engineering guidance and we agree with all of it. The catch is that most support teams do not own the billing or order APIs Fin calls. The engineers who do are rarely asked to add refund caps and ownership checks for a support bot project, so the limits Fin assumes exist often do not.
How Fin Procedures and data connectors take actions
A data connector is an HTTP call to one of your API endpoints that Fin can make during a conversation. Fin can call a connector directly, or an admin can place it inside a Procedure step by typing @ and selecting "Call data connector", and connectors also run from Workflows and inbox macros. Connectors are available on all Fin pricing plans and in US, EU and AU hosted workspaces.
The flow Fin documents for a write action is "looking up an order, then offering to update it, then confirming the change." The person who confirms is the customer in the conversation. That is the right step for a customer who really wants a refund, and it adds nothing when the person in the conversation is the one trying to abuse it. We found no documented step where a member of your team approves a specific connector call before it runs.
| Action type | Typical connector | Risk if the input is wrong or hostile |
|---|---|---|
| Look up | Order status, plan, shipment tracking | Data exposure to an unverified person |
| Change | Update address, change plan, pause subscription | Account takeover steps, rerouted shipments |
| Money out | Refund, credit, discount code | Direct loss, duplicated payouts |
| Destructive | Cancel subscription, delete account | Churn you did not intend, data loss |
Lookups are where Fin's own JWT, passcode and Security tab controls do most of the work. The last two rows are where a second control earns its keep.
What the Salesforce acquisition changes for Fin security reviews
Intercom renamed itself Fin in May 2026, while the helpdesk product kept the Intercom name. Salesforce signed a definitive agreement to buy Fin on June 15, 2026 and completed the acquisition on September 10, 2026, earlier than the window first announced. Salesforce's release says Fin's customer base is "more than 30,000 companies", that Fin continues as part of Salesforce AI Labs, and that its agent "works seamlessly with the help desks and systems companies already use."
Nothing in the release changes how connectors or Procedures work today. Three things are still worth doing during a renewal. Ask for the current subprocessor list from the trust center and compare it with the one you approved. Write pricing and data processing terms into the order form rather than relying on the current public page. And if your company also runs Agentforce, decide now whether Fin and Agentforce actions on the same billing and account systems will share one policy and one record, because each platform will keep its own logs.
Intercom Fin pricing and the security lines outside it
Fin publishes its prices, which most enterprise AI agents do not. These figures come from fin.ai/pricing, read on October 24, 2026. Confirm them on your order form.
| Item | What Fin publishes |
|---|---|
| Fin with another helpdesk | 0.99 USD per outcome, 50 outcomes per month minimum, no additional seat costs |
| Fin with the Intercom helpdesk | From 0.99 USD per outcome plus a helpdesk seat price |
| What counts | One outcome per conversation even if Fin takes several actions. Resolutions, Procedure handoffs, disqualifications, self-serve routings and qualifications are billable. Qualifications cost 9.99 USD each |
| Not charged | Conversations passed to your team without an outcome |
| Add-ons | Pro from 100 USD per month, Copilot 35 USD per user per month, Fin Voice on custom pricing |
Because Fin charges per outcome rather than per action, a conversation in which Fin refunds an order three times costs the same 0.99 USD as one in which it refunds it once. The bill will not warn you. Budget three security lines next to the outcome cost: engineering time to add caps, ownership checks and idempotency to every write endpoint, review time for the refunds and changes your rules hold, and any control you put in front of those endpoints.
Intercom Fin security checklist for US support teams
- List every data connector, its HTTP method and the endpoint it calls. Mark each one as look up, change, money out or destructive.
- Turn on Messenger Security with JWTs. For email, Leads and any channel without login, require a one-time passcode before a connector runs.
- Clear every flag on each connector's Security tab before it goes live, and keep the list of accepted risks in your review notes.
- Restrict Fin's data access to the fields it needs, and ask the API owner to return only those fields.
- For every write endpoint, confirm three things in the API code: an ownership check on the record, a per-customer and per-day limit, and an idempotency key.
- Test write connectors against a staging API. Fin warns that testing a DELETE call on a user really deletes the user.
- Launch with audience rules, starting with your own team and a small customer segment.
- Read the connector logs and inbox activity weekly for the first month, and reconcile refunds Fin issued against your billing system.
- Decide who on your team approves a refund above your threshold, and how fast, before you let Fin issue one.
When to buy nothing, use Fin controls, or add AgentShield
| Your situation | What to do |
|---|---|
| Fin answers from your help center and hands off to people, with no data connectors | Buy nothing. Fin's certifications and content controls cover this |
| Fin uses read-only connectors for order status and plan lookups | Buy nothing. Turn on JWTs and passcodes, clear the Security tab, limit returned fields |
| You own the billing API and can add caps, ownership checks and idempotency this quarter | Buy nothing. Build them into the API, exactly as Fin's guide recommends |
| You want a staged launch for a new write connector | Use Fin. Audience rules and connector logs handle this well |
| Fin issues refunds, credits or account changes against APIs your team does not control | Add AgentShield in front of those endpoints, with argument rules and a named approver above your threshold |
| Fin, Agentforce or in-house agents act on the same billing and account systems | Add AgentShield as one policy and one record across every agent |
Four of six rows end without a purchase from us. If you also run Zendesk, our Zendesk AI agents security page covers the matching controls there, and the broader AI customer support agent security page covers DLP and content filtering across support bots. For a side-by-side of the options Fin buyers shortlist, read our AI agent security software for Intercom Fin buyer guide, and for the approval mechanics themselves see approval gates for AI agents.
FAQ
Common questions about intercom fin ai agent security.
Is Intercom Fin secure?
Fin is well secured as a platform. It holds SOC 2 Type II, ISO 27001 and ISO 42001, Fin AI Agent is AIUC-1 certified, and it offers JWT Messenger security, one-time passcodes and pre-launch connector checks. The open risk is what your data connectors allow, because Fin documents refund caps, ownership checks and idempotency as your API's job.
Can Fin AI agent issue refunds?
Yes. Through a data connector, Fin can call your billing or order API during a conversation, usually inside a Procedure that looks up the order, offers the refund and asks the customer to confirm. Fin itself sets no documented refund limit, so its guide tells you to cap refunds per day in your API and make the endpoint idempotent.
What are Fin data connectors?
Data connectors are HTTP calls from Fin to your own API endpoints, used to read data such as order status or to take actions such as cancelling a subscription. Fin can call them directly or inside Procedures, Workflows and inbox macros. They are available on all Fin pricing plans, and creating one needs the Can access developer hub permission.
Does Fin verify customer identity before taking actions?
Only if you set it up. Fin strongly recommends Messenger Security with JWTs, and warns that without customer authentication, malicious actors could impersonate your users and access their data. Messenger authentication does not apply to Leads or other channels, where Fin recommends a one-time passcode before exposing data or running a connector.
Is Intercom now owned by Salesforce?
Yes. Intercom renamed the company Fin in May 2026, and Salesforce completed its acquisition of Fin on September 10, 2026. Salesforce says Fin continues as part of Salesforce AI Labs and keeps working with the helpdesks customers already use. The Intercom name remains on the helpdesk product.
How much does Intercom Fin cost?
Fin lists 0.99 USD per outcome. On another helpdesk there is a 50 outcome monthly minimum and no seat cost, while Fin on the Intercom helpdesk adds a seat price. Fin charges one outcome per conversation even if it takes several actions, and conversations handed to your team without an outcome are not charged.
Is Intercom Fin HIPAA compliant?
Fin states it has completed a HIPAA attestation examination and can enter into business associate agreements, and it publishes the attestation letter in its trust center. A BAA covers Fin's handling of the data. Which records your connectors fetch and expose in a conversation is still your configuration to review.
Does AgentShield work with Intercom Fin?
Yes, on the APIs Fin's data connectors call. Point a write connector at an AgentShield gateway endpoint in front of your API. Rules check the arguments, such as refund amount, order owner and repeat requests. Routine calls pass, matching ones wait for a named teammate and return a pending status your Procedure can hand off on, and every decision is recorded.
More use cases