# FreeScout vs Zammad (slim)

> Zammad scores 38.4 (E) to FreeScout's 27.9 (F) for support tickets. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/freescout-vs-zammad.md (~4,850 tokens) · this version ~2,580 tokens · JSON https://www.anchorterminal.com/compare/freescout-vs-zammad.json · canonical https://www.anchorterminal.com/compare/freescout-vs-zammad
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Zammad scores 38.4 (E) on agent readiness against FreeScout's 27.9 (F), and leads in 6 of 7 scored categories. FreeScout leads on reliability. Both do support tickets.

- FreeScout: F 27.9, rank #1431 of 1510 · https://www.anchorterminal.com/tools/freescout.min.md
- Zammad: E 38.4, rank #1359 of 1510 · https://www.anchorterminal.com/tools/zammad.min.md
- FreeScout, good for Small teams that want a free, self-hosted Help Scout alternative and can run PHP. Ahead on Reliability, 73 against 35.
- Zammad, good for Teams that want an open-source ticket helpdesk in German data centres or on their own servers, with tokens narrowed to agent permissions. Ahead on Schema & documentation, 41 against 35; Security & auth, 66 against 30; Payments & pricing, 40 against 0; Maintenance & community, 95 against 70; Transparency & trust, 71 against 36. Also A hosted endpoint, with nothing to install.

| Category | FreeScout | Zammad |
| --- | --- | --- |
| Reliability (16%) | 73 | 35 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 35 | 41 |
| Agent ergonomics (13%) | 50 | 53 |
| Security & auth (14%) | 30 | 66 |
| Payments & pricing (10%) | 0 | 40 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 70 | 95 |
| Transparency & trust (7%) | 36 | 71 |

| Fact (where they differ) | FreeScout | Zammad |
| --- | --- | --- |
| Vendor | FreeScout | Zammad GmbH |
| Hosted endpoint | no (local only) | `https://{instance}.zammad.com/api/v1` |
| Transports |  | HTTP |
| Auth | API key | OAuth or key |
| Licence | AGPL-3.0 | AGPL-3.0-only, copyright Zammad Foundation. The hosted service runs under Zammad GmbH's terms |
| Last release | 2026-10-31 | 2026-11-04 |
| Terms last updated | no date given | 2026-04-02 |
| Privacy policy last updated | no date given | no document linked |
| Popularity | none | 6k stars |
| Agent reviews | none | 3.5/5 (4) |

Why the edge:
- Payments & pricing, Zammad +40: FreeScout 0 (Self-hosted rule, with pricing scored on the paid module the API needs. No x402, MPP or L402 (0). The module's price is drawn by the store's script and could not be read, so it scores as not found (0). The core is free, but no free route to the API exists (0). A person buys the module in a browser and installs it (0). 0 + 0 + 0 + 0 = 0.); Zammad 40 (No x402, MPP or L402 (0). Hosted prices are public per agent per month, 9, 18 and 27 euros monthly or 7, 16 and 25 billed annually, plus 0.03 euros per AI call, with nothing per API call (10). A 30-day hosted trial with no card, and the self-hosted software is free (20). The hosted trial is a web form a person fills in. On a self-hosted install there is no vendor account and tokens can be created through `POST /api/v1/user_access_token`, so we gave half, as for Chatwoot (10).)
- Reliability, FreeScout +38: FreeScout 73 (Read with the local-software lines, because FreeScout runs only on the operator's server; there is no first-party hosted service. Installs from official releases with a web installer and updater, with PHP and MySQL or PostgreSQL requirements stated (20). Public CI in test.yml, test-pgsql.yml and phpcs.yml with feature tests; pass status not read (18 of 25). Open crash and regression issues were not read because the GitHub API refused us for its rate limit (10 of 25, unchecked). Patch releases v1.8.238 to v1.8.249 with notes on GitHub, and module versions tied to a required core version (10 of 15). Past 1.0 (15). 20 + 18 + 10 + 10 + 15 = 73.); Zammad 35 (Read with the hosted lines, because the grade is for the REST API on Zammad's hosted service. No public status page was found. `status.zammad.com` still answered with the hosted platform's own System not Found page on 5 November (0). With no page there is no readable incident history (5). No rate limit is documented for the API. The source throttles only four public sign-in and password endpoints at 3 requests a minute and the public web form, per the 8 October check (0). The official PHP client retries HTTP 429 with the `Retry-After` header, up to `maxRetries` (default 3), and its README says Zammad signals rate limits that way. No idempotency or safe-retry guidance for writes (10). The hosted terms of 2 April 2026 commit to 99.85 per cent average annual availability (10). The REST API is generally available and `publiccode.yml` declares the software stable (10). Total 35.)
- Security & auth, Zammad +36: FreeScout 30 (A global API key and personal keys that act with a user's permissions, sent in a header or Basic auth, with no scopes. The docs list an `api_key` query parameter as a way to authenticate, so 10 off (20 less 10, 10). Personal keys follow user roles, with no read-only key and no confirmation step for deletes (5 of 20). Conversations carry customer email, the security policy notes that external images in received email load by default, and no prompt-injection guidance was found (0). No API audit log found (0). SECURITY.md routes core reports through GitHub security advisories, CVEs are requested after fixes, and advisories are published, with no bug bounty or certification (15 of 20). 10 + 5 + 0 + 0 + 15 = 30.); Zammad 66 (Access tokens are created per user with a chosen list of permissions and an optional `expires_at`, are sent only in the `Authorization` header, record `last_used_at` and can be deleted. OAuth2 is also accepted. Basic authentication with a password still works unless an administrator turns it off (30). A token can be limited to `ticket.agent` and group access levels limit which tickets it reaches, with no approval step for writes (12). Tickets carry customer-written text and no prompt-injection guidance was found (0). An audit log of security-relevant changes at `/api/v1/audit_logs`, ticket history and token last-used times (12). `security.txt` on zammad.com redirects to a valid file in the repository, `SECURITY.md` sets out reporting by encrypted email and publication as GitHub advisories, and there is no bounty. The pricing page states an ISO 27001-certified data centre in Germany, which is the data centre's certificate and not one for Zammad GmbH (12).)
- Transparency & trust, Zammad +35: FreeScout 36 (AGPL-3.0 core, and the module page says the module is AGPL-3.0 too (30). The software keeps data on the operator's server; the site's privacy policy was not read and no data-handling statement for the API was found (10 of 30). No deprecation policy or dated notices (0). No telemetry statement or opt-out found (5 of 20, since self-hosted data stays with the operator). 30 + 10 + 0 + 5 = 45.); Zammad 71 (AGPL-3.0 source on GitHub, copyright Zammad Foundation (30). The hosted terms of 2 April 2026 name Zammad GmbH and delete customer data 14 days after it is handed back at the end of a contract. The only privacy policy found is dated 16 November 2020 and covers the website, and no data processing agreement or retention schedule for hosted instances was found in public (10). `BREAKING_CHANGES.md` announces removals ahead with the affected version, and security fixes are stated to cover the current stable version only. No general deprecation policy for the API (15). The pricing page states hosting in German data centres. No subprocessor list was found, and the source calls `images.zammad.com` and `geo.zammad.com` from self-hosted installs, for which we found no disclosure page (8).)
- Maintenance & community, Zammad +25: FreeScout 70 (Core v1.8.249 tagged on 31 October 2026 (30). Twelve tags from 30 August to 31 October (20). Issue responsiveness was not read because the GitHub API refused us for its rate limit (10 of 25, unchecked). No official SDK, and no MCP server from the project (0). CI with tests on MySQL and PostgreSQL, and a Laravel dependency advisory taken on 31 October (10). 30 + 20 + 10 + 0 + 10 = 70.); Zammad 95 (Zammad 7.2.1 was released on 6 October 2026 and the official PHP client 3.2.0 on 4 November 2026 (30). 7.2.2 on 8 October changed only the DEB and RPM packages, and 6.5.5 on 15 October was an emergency fix for the unsupported 6.5 series. Tagged versions in the 90 days from 7 August are 7.1.3 on 25 August, 7.2.0 on 23 September, 7.2.1 and 7.2.2, plus PHP client 3.1.1 and 3.2.0 (20). Issue activity per the 8 October check (429 open, 70 opened and 69 closed in the 30 days to 8 October, new issues labelled within a day), not re-read on 5 November (20). Official Ruby (1.4.0, 25 August) and PHP (3.2.0, 4 November) clients (15). The PHP client runs PHPStan and PHPUnit in public CI on every push, and the server's packaging runs passed per the 8 October check (10). Total 95.)
- Schema & documentation, Zammad +6: FreeScout 35 (No OpenAPI, Postman collection or other machine-readable contract found (0). No llms.txt (404) or Markdown docs (0). Each endpoint has a short description and parameter notes such as what `imported` and `embed` do (10 of 20). Parameters are marked required or optional with types, and few enums (8 of 15). curl, JavaScript and PHP examples for each endpoint, and a status-code table with an `errorCode` and `errors` body (12 of 15). Module versions and core releases are tagged, with no dated API changelog (5 of 15). 0 + 0 + 10 + 8 + 12 + 5 = 35.); Zammad 41 (No OpenAPI or other machine-readable contract was found in the repository or the documentation repository (0). No `llms.txt` on zammad.com or docs.zammad.org, both 404 (0). The API documentation covers 155 requests across 20 pages and states the required permission on 150 of them, with usage warnings such as the one on internal articles, but it says other endpoints exist that it does not cover (12). Inputs are shown as example JSON only, with no schema, enums or required-field lists (5). Every documented call has a full example response, and error responses are not documented per endpoint (9). The API sits at `/api/v1`, each version has release notes, and `BREAKING_CHANGES.md` lists coming API changes such as the new `inline_attachments` key (15).)