FreeScout vs Zammad

FreeScout 0

Self-hosted rule, with pricing scored on the paid module the API needs. No x402, MPP or L402 (0). The module's price is drawn by the store's script and could not be read, so it scores as not found (0). The core is free, but no free route to the API exists (0). A person buys the module in a browser and installs it (0). 0 + 0 + 0 + 0 = 0.

Zammad 40

No x402, MPP or L402 (0). Hosted prices are public per agent per month, 9, 18 and 27 euros monthly or 7, 16 and 25 billed annually, plus 0.03 euros per AI call, with nothing per API call (10). A 30-day hosted trial with no card, and the self-hosted software is free (20). The hosted trial is a web form a person fills in. On a self-hosted install there is no vendor account and tokens can be created through POST /api/v1/user_access_token, so we gave half, as for Chatwoot (10).

FreeScout 73

Read with the local-software lines, because FreeScout runs only on the operator's server; there is no first-party hosted service. Installs from official releases with a web installer and updater, with PHP and MySQL or PostgreSQL requirements stated (20). Public CI in test.yml, test-pgsql.yml and phpcs.yml with feature tests; pass status not read (18 of 25). Open crash and regression issues were not read because the GitHub API refused us for its rate limit (10 of 25, unchecked). Patch releases v1.8.238 to v1.8.249 with notes on GitHub, and module versions tied to a required core version (10 of 15). Past 1.0 (15). 20 + 18 + 10 + 10 + 15 = 73.

Zammad 35

Read with the hosted lines, because the grade is for the REST API on Zammad's hosted service. No public status page was found. status.zammad.com still answered with the hosted platform's own System not Found page on 5 November (0). With no page there is no readable incident history (5). No rate limit is documented for the API. The source throttles only four public sign-in and password endpoints at 3 requests a minute and the public web form, per the 8 October check (0). The official PHP client retries HTTP 429 with the Retry-After header, up to maxRetries (default 3), and its README says Zammad signals rate limits that way. No idempotency or safe-retry guidance for writes (10). The hosted terms of 2 April 2026 commit to 99.85 per cent average annual availability (10). The REST API is generally available and publiccode.yml declares the software stable (10). Total 35.

FreeScout 30

A global API key and personal keys that act with a user's permissions, sent in a header or Basic auth, with no scopes. The docs list an api_key query parameter as a way to authenticate, so 10 off (20 less 10, 10). Personal keys follow user roles, with no read-only key and no confirmation step for deletes (5 of 20). Conversations carry customer email, the security policy notes that external images in received email load by default, and no prompt-injection guidance was found (0). No API audit log found (0). SECURITY.md routes core reports through GitHub security advisories, CVEs are requested after fixes, and advisories are published, with no bug bounty or certification (15 of 20). 10 + 5 + 0 + 0 + 15 = 30.

Zammad 66

Access tokens are created per user with a chosen list of permissions and an optional expires_at, are sent only in the Authorization header, record last_used_at and can be deleted. OAuth2 is also accepted. Basic authentication with a password still works unless an administrator turns it off (30). A token can be limited to ticket.agent and group access levels limit which tickets it reaches, with no approval step for writes (12). Tickets carry customer-written text and no prompt-injection guidance was found (0). An audit log of security-relevant changes at /api/v1/audit_logs, ticket history and token last-used times (12). security.txt on zammad.com redirects to a valid file in the repository, SECURITY.md sets out reporting by encrypted email and publication as GitHub advisories, and there is no bounty. The pricing page states an ISO 27001-certified data centre in Germany, which is the data centre's certificate and not one for Zammad GmbH (12).

FreeScout 36

AGPL-3.0 core, and the module page says the module is AGPL-3.0 too (30). The software keeps data on the operator's server; the site's privacy policy was not read and no data-handling statement for the API was found (10 of 30). No deprecation policy or dated notices (0). No telemetry statement or opt-out found (5 of 20, since self-hosted data stays with the operator). 30 + 10 + 0 + 5 = 45.

Zammad 71

AGPL-3.0 source on GitHub, copyright Zammad Foundation (30). The hosted terms of 2 April 2026 name Zammad GmbH and delete customer data 14 days after it is handed back at the end of a contract. The only privacy policy found is dated 16 November 2020 and covers the website, and no data processing agreement or retention schedule for hosted instances was found in public (10). BREAKING_CHANGES.md announces removals ahead with the affected version, and security fixes are stated to cover the current stable version only. No general deprecation policy for the API (15). The pricing page states hosting in German data centres. No subprocessor list was found, and the source calls images.zammad.com and geo.zammad.com from self-hosted installs, for which we found no disclosure page (8).

FreeScout 70

Core v1.8.249 tagged on 31 October 2026 (30). Twelve tags from 30 August to 31 October (20). Issue responsiveness was not read because the GitHub API refused us for its rate limit (10 of 25, unchecked). No official SDK, and no MCP server from the project (0). CI with tests on MySQL and PostgreSQL, and a Laravel dependency advisory taken on 31 October (10). 30 + 20 + 10 + 0 + 10 = 70.

Zammad 95

Zammad 7.2.1 was released on 6 October 2026 and the official PHP client 3.2.0 on 4 November 2026 (30). 7.2.2 on 8 October changed only the DEB and RPM packages, and 6.5.5 on 15 October was an emergency fix for the unsupported 6.5 series. Tagged versions in the 90 days from 7 August are 7.1.3 on 25 August, 7.2.0 on 23 September, 7.2.1 and 7.2.2, plus PHP client 3.1.1 and 3.2.0 (20). Issue activity per the 8 October check (429 open, 70 opened and 69 closed in the 30 days to 8 October, new issues labelled within a day), not re-read on 5 November (20). Official Ruby (1.4.0, 25 August) and PHP (3.2.0, 4 November) clients (15). The PHP client runs PHPStan and PHPUnit in public CI on every push, and the server's packaging runs passed per the 8 October check (10). Total 95.

FreeScout 35

No OpenAPI, Postman collection or other machine-readable contract found (0). No llms.txt (404) or Markdown docs (0). Each endpoint has a short description and parameter notes such as what imported and embed do (10 of 20). Parameters are marked required or optional with types, and few enums (8 of 15). curl, JavaScript and PHP examples for each endpoint, and a status-code table with an errorCode and errors body (12 of 15). Module versions and core releases are tagged, with no dated API changelog (5 of 15). 0 + 0 + 10 + 8 + 12 + 5 = 35.

Zammad 41

No OpenAPI or other machine-readable contract was found in the repository or the documentation repository (0). No llms.txt on zammad.com or docs.zammad.org, both 404 (0). The API documentation covers 155 requests across 20 pages and states the required permission on 150 of them, with usage warnings such as the one on internal articles, but it says other endpoints exist that it does not cover (12). Inputs are shown as example JSON only, with no schema, enums or required-field lists (5). Every documented call has a full example response, and error responses are not documented per endpoint (9). The API sits at /api/v1, each version has release notes, and BREAKING_CHANGES.md lists coming API changes such as the new inline_attachments key (15).