Does Gorgias AI Agent sign a BAA?

No BAA available

Gorgias's Master Subscription Agreement bars customers from uploading HIPAA protected health information, and no Gorgias page offers a BAA. Its security page does list a HIPAA report available on request.

Based on 2 sources, all from Gorgias unless marked.

Business associate
Gorgias
Tool
Gorgias AI Agent
Plans with a BAA
None
Checked
No BAA
Gorgias won't sign a BAA for Gorgias AI Agent.

By plan

PlanBAAHow to get itConditions
All plans (Master Subscription Agreement)No BAANot offeredSection 3.1(F) of the MSA bars customers, agents and end users from uploading HIPAA PHI. Gorgias also disclaims all liability for any PHI supplied. No page mentions a BAA. The security page lists 'HIPAA Compliance' with a report available on request, but that is not a BAA offer.[1],[2]

Are the AI features covered?

Vendors often sign a BAA for the core product but leave some AI features out. Here is what Gorgias says about each one.

AI featureUnder the BAADetails
AI AgentExcludedThe PHI prohibition covers all Customer Data in the Services, so it applies to the AI Agent too. The MSA says third-party AI providers operate under zero data retention and that Customer Data is not used to train third-party models.[1]

Customer support AI that offer a BAA

  • AdaBAA on: Enterprise contracts (Ada is sales-led)Some plans only
  • Freshdesk / Freddy AIBAA on: Freshdesk, Freshchat (standalone), Freshcaller, Freshdesk OmnichannelSome plans only
  • Intercom FinBAA on: Fin workspaces (Fin AI Agent standalone), Intercom ExpertSome plans only
  • Jotform AI AgentsBAA on: Enterprise, GoldSome plans only
  • Kustomer AIBAA on: Enterprise or Ultimate with HIPAA add-on packageSome plans only
  • LivePerson Conversational CloudBAA on: Conversational Cloud (enterprise contracts)Some plans only

All BAA-ready alternatives to Gorgias AI Agent

Sources

  1. Gorgias Master Subscription AgreementGorgias, Legal terms. Checked Oct 11, 2026.
  2. Gorgias - Security PolicyGorgias, Trust center. Checked Oct 11, 2026.

A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.