You know where your data lives.

In the European Union, in three locations: the database in Helsinki (Finland), the files and media you upload in Frankfurt (Germany), and database backups in Falkenstein (Germany). We have no component in Turkey and no region-selection feature. Seen from a company in Turkey this is a transfer abroad within the meaning of Article 9 of Law No. 6698; we establish the basis for that transfer together with you during the contract process and give you in writing which component sits in which country. The full list of parties that touch your data is in the subprocessor table on this page; the legal basis for each transfer is set out in Sections 8 and 13 of our Privacy Policy.

We do not make that claim, because we have not measured it: we hold no GDPR certification and have been through no external compliance audit. What we can state is concrete, and it is what a legal team usually asks first — where the data sits. Your database is in Helsinki (Finland), your files in Frankfurt (Germany), your backups in Falkenstein (Germany); all three are inside the European Union. Hosting and storage sit inside the EU; Anthropic (US), Cloudflare (a US company) and Meta (Ireland/US) do not. Anthropic applies only if you enable Rapi, Meta only if you connect WhatsApp or Instagram. The subprocessor table on this page names every party that touches your data and gives the country for each one, including outbound email through Amazon SES in the Frankfurt region.

We do not publish a data processing agreement, and there is no DPA document on this site to download. We are not going to describe a document we have not written. What exists today is this: the contractual counterpart of everything on this page — who processes your data, in which country, and on what basis the transfer abroad is made — is drawn up with you during the contract process, and we put the details in writing during an enterprise evaluation. If your procurement process needs a signed data processing agreement before a technical evaluation can begin, raise it at the first call: it is a legal step, not a product setting, and it is better on the table from the start than discovered late.

Rapi is off by default; to use it you have to top up credit on your account separately. Until you do, none of your CRM data is sent to any AI provider. Once you enable Rapi, the record content relevant to the question you ask is sent to Anthropic's Claude model in the United States — a second transfer abroad under Article 9 of KVKK, separate from the hosting in Finland, and one we state in our privacy notice. Anthropic commits not to use data sent through its API to train models.

Not your CRM records. Every customer runs in its own separate database; data is not filtered by company ID in a shared table. This separation sits at the database layer rather than the application layer. Against that, we make no claim of a separate server, customer-specific hardware or a customer-specific database password: what we state is separation at the database level. There is one exception and we state it explicitly: the application's technical error logs are kept in a single table shared by all customers, and an entry can contain personal data from the request that failed. Those logs are kept only for fault diagnosis; they are not your CRM content.

Access to customer data is limited to authorised personnel. We do not say "nobody ever looks at your records" — we have not measured that, and we do not commit to something we have not measured. Here is what we did measure: when an error occurs, the application writes the trace to an error log table shared by all customers, and that table can hold the user's email address, IP address and the body of the request; this is the place the support and debugging flow reads. Against that, every field change inside the application is written to the audit trail, and you see that trail too — so if something in your records changed, you can see who did it. During an enterprise evaluation we share our access policy in writing.

Yes. A separate history record is kept for every changed field: which user, when, the old value and the new value. It is viewed from the History tab on record screens, can be queried field by field from the API, and its retention period is manageable. It is on by default across every object that ships in a standard install.

Yes. Our breach process is built on Law No. 6698: notification is made to the Turkish Personal Data Protection Board and to the individuals concerned within the period and in the manner that Law requires. Because you will have your own notification obligation as the data controller, you are informed without delay. Two limits, stated plainly: we do not give a contractual notification deadline of our own, and our process is not written against a second breach-notification regime in addition to Law No. 6698. If a fixed deadline or a particular regime is one of your procurement requirements, bring it to the call and we will tell you what we can commit to.

No. We hold neither an ISO 27001 certificate nor a SOC 2 report — and we will not claim one until we have it. We do not use in-between phrases such as “we are in the certification process” or “we are compliant with the standards” either. If you have a requirement for a certified supplier, it is worth knowing that at the start of your evaluation. Against that, the same team that builds the product fills in your enterprise security assessment forms and walks through the architecture on a screen share.

No. We publish no uptime percentage; we do not measure uptime with an independent external monitoring service, and we do not publish a figure we have not measured. We give no written response-time commitment either. If a guaranteed service level is one of your requirements, let us talk about it at the start of the evaluation; every obligation we take on contractually, and the limits of each one, is written out on our Terms of Service page.

We have no independent penetration test report, and we do not say we have had one done. With the organisations that ask for a security assessment, we go through that process together in a call.

Deletion here is soft deletion: the record does not leave the database at once, it moves to the recycle bin and stays there for 30 days. That is what we measured. We have not measured who can perform a restore from the bin, which profiles have it enabled, or whether a separate individual or bulk restore operation exists — we do not commit to a capability we have not measured. Permanent deletion is a separate permission; an ordinary user cannot destroy a record irreversibly.

Records belong to the company, not to the user. When a user account is closed, the records they created stay in place and can be reassigned to another owner; the account's access is cut immediately and the action is written to the audit trail.

Yes. You can export your data in standard formats, and you can also pull it programmatically through our REST API, which covers the 183 business objects that ship in a standard install. If you decide to leave, we charge no extra fee for data export; this is written into our Terms of Service.

There is no call centre on our support line. Your question is answered by the team that builds and develops the product — this is a choice, not a matter of capacity. The same team fills in your enterprise security assessment forms and walks through the architecture on a screen share. We give no written response-time commitment.

Support is provided during Turkish business hours. If you have teams in other time zones, let us discuss the scope together in a call.