We ran a real export from a live Intercom workspace and opened every object in it, because we wanted to know precisely what a compliance officer would be holding if a regulator asked them to produce a support conversation from two years ago.
This is what is in the file, what is not, and which of the two an auditor cares about.
What the export actually contains
Intercom's JSON export to Amazon S3 or GCS is real, and it is better than it is often assumed to be. A two-year historical export from a live workspace, inspected object by object:
conversations : 12
conversation parts : 59
parts with a body : 35
Thirty-five parts carry the actual message HTML — from teammates and end users alike, not just bot replies. The export is built on the same underlying data as the public Conversations API, and it includes full message content by design.
One distinction is worth getting right before you rely on anything:
- The JSON export to Amazon S3 or GCS — configured in your workspace's data export settings. Contains full message content.
- The CSV "Dataset export" in Reports — IDs, timestamps, attributes and metrics. No message content.
If your retention plan rests on an export, confirm which of the two you are actually running. They are not interchangeable, and only one of them contains a conversation.
So if the question is "can I get my transcripts out of Intercom?" — yes. On a schedule, into a bucket you own, at no extra cost. Go and configure it. This post will still be here.
That answers a data question. It does not answer a compliance question.
Five things the export does not give you
Every item below was true of the file we inspected, and is structural rather than a bug — an export is a copy of current state, and a copy has these properties no matter who produces it.
1. Nothing demonstrates the file is unaltered
The export lands in a bucket. Anyone with write access to that bucket — an engineer, a misapplied IAM policy, a compromised CI key, a departing administrator — can edit a conversation or delete one, and the file gives you no way to detect that it happened.
In 2029 you would be producing a JSON file and asserting it is what Intercom wrote. There is nothing inside it that establishes that. For anyone operating under a WORM retention obligation, or answering SOC 2 CC6 and CC7 questions about integrity of stored records, this is the whole ballgame.
2. There is no legal hold
When a dispute or an investigation begins, you need specific conversations excluded from every deletion path, immediately, with a record of when the hold was placed, by whom, and why.
A lifecycle rule on a bucket is not a legal hold. It applies to everything or nothing, it can be edited by whoever owns the bucket, and it leaves no evidence of the decision. Spoliation findings turn on exactly that gap.
3. Erasure and retention conflict, with no way to satisfy both
A GDPR Article 17 request arrives for a customer whose conversations you are also legally required to retain. Delete the object and you break retention. Keep it and you have refused a valid erasure request.
An export offers you no third option. This is the single most common place we see a retention policy quietly fail its first real test.
4. It is not readable and not searchable
A folder of JSON is a data format, not a record. Producing one conversation for a regulator means an engineer writing a script, on a deadline, and then someone attesting that the script did what it claims. Every hour of that is an hour you did not plan for.
5. There is no history
Each export is a snapshot of current state. Edit a message, change a tag, delete a conversation, and the prior version is gone — unless you happened to export in between and kept both files. "What did this conversation say before it was edited?" is unanswerable.
The test that decides it
"Do you retain support communications?" is answered by a copy.
"Can you demonstrate this record has not been altered since it was created, place a hold on specific records during litigation, and act on an erasure request without breaking your retention obligation?" is not.
If you have no retention obligation and no realistic dispute risk, configure the S3 export and stop reading. It is free, it works, and it contains what you need. We would rather tell you that than sell you something you do not need.
If you answer questionnaires for a living, keep going.
What Converight adds
Converight connects to Intercom over read-only OAuth and archives the same conversations into storage built for evidence rather than for convenience.
Immutable by construction. Every archived object is written under S3 Object Lock. It cannot be modified or deleted before its retention date by any account — including ours. We hold no capability we could be compelled or tricked into using, and an organisation-level policy denies the permission that would bypass it.
Legal Hold that outranks everything. Place a hold on a conversation, a contact, a company or an entire workspace. A held record is excluded from every deletion path in the system, including your own retention policy and your own account cancellation. The hold, its author and its timestamp are part of the audit record.
Erasure that survives immutability. Each record is encrypted with its own key. Erasing one destroys that key, not the object — the record becomes permanently and irreversibly unreadable while the object itself stays under Object Lock.
Whether a given request must be honoured, and what you are obliged to retain instead, are decisions for you and your counsel. What this gives you is the mechanism to act on that decision at all, which is the thing an export structurally cannot offer: with a folder of JSON, deleting the file breaks retention and keeping it refuses the request.
A tamper-evident audit log. Every backup run and every human action — view, search, export, download — is written to a hash-chained log. Any alteration to the history breaks the chain and is detectable. The log exports as evidence, and the database itself rejects updates and deletes against it.
Evidence you can hand to a regulator. Search by customer, date or tag. Read the transcript as it was archived. Export it as JSON, CSV or PDF with its SHA-256 checksum attached, so the recipient can verify the file independently.
Backups that tell you when they fail. Daily incremental syncs of conversations, contacts, companies, tags, articles, admins and teams. A missed run alerts us before you notice it — a backup nobody is watching is a backup you find out about during the audit.
None of this is about access to your data. Intercom already gives you that. It is about whether what you hold is a copy or a record.
Ten minutes, on your own export
Worth doing whichever conclusion you reach:
- Confirm you are running the JSON/S3 export and not the CSV Dataset export. Only one of them contains message content.
- List everyone and everything with write access to that bucket. Include CI roles and any key issued more than a year ago.
- Ask what you would produce if a regulator wanted one conversation from 2024 — and how you would show it had not been modified since.
The third question is the one that decides whether a copy is enough for you.
Start archiving today
Read-only OAuth, first backup running in under ten minutes, no engineering work and no sales call. Pricing is published: $199/month up to 50,000 archived conversations, $499/month unlimited. Founding customers get 40% off for twelve months.
Connect your Intercom workspace →
Not ready to connect anything? Request a SOC 2 readiness gap analysis — free for founding customers. Tell us your company and where you are in the audit, and you get back an analysis of which of the gaps above apply to you. It is a readiness review, not an audit, and we are not an auditor; the page says so in more detail.
Converight is built by Thinkdata Labs LLP. We are not affiliated with Intercom. The export inspected here was our own workspace, and the inspection script is in our repository.