Skip to content
Try free for 7 days
Security

You know where your data lives.

Most CRM security pages say "enterprise-grade protection" and move on. We wrote ours concretely: which country your data sits in, who can reach it, how far we can tell who changed which record, and which third parties touch your data, every one by name and country.

Try free for 7 days Privacy Policy

The foundation of the architecture.

A separate database per customer

Every customer runs in its own separate database. Not a "company ID" filter in a shared table. Each customer's data sits in its own database, and the application routes each request to the right database based on the web address it arrives at. One exception we state openly: the application's technical error logs are kept in a single table shared by all customers.

Hosted in the EU, stated openly

The database is in Helsinki (Finland), the files you upload are in Frankfurt, and database backups are in Falkenstein, all three inside the European Union. We have no component in Turkey and no region-selection feature. Seen from Turkey this is a transfer abroad under Article 9 of KVKK; we establish the basis for that transfer together with you during the contract process.

Field-level audit trail

A separate history row is kept for every field change users make to an existing record: the time, the old value, the new value (protected fields: a marker, not the values). The record's initial creation and some bulk updates the system makes in the background are not recorded. Field history is on by default across every object that ships in a standard install; you do not need to enable it.

Recycle bin

Deletion is soft deletion: the record does not leave the database at once, it moves to the recycle bin, where an authorised user can restore it one by one or in bulk. Records in the recycle bin are deleted automatically after 30 days. Consent and legal-evidence records, and records still linked to other records, are kept. An authorised user can permanently delete records from the bin.

Access, identity and the third parties that touch your data

Subprocessor list. Hosting and storage are inside the EU; Anthropic (US), Cloudflare (a US company) and Meta (Ireland/US) sit outside it. We update this page whenever the list changes.
Control or partyHow and where it works
Two-factor authentication (2FA)On by default for every user. The default method is an email code; an authenticator app is also supported (set up with a QR code, backup codes).
API authenticationOAuth2; API client secrets are stored as one-way hashes. Each API client can be granted read, write and delete scopes separately; the server checks these scopes on the general record API (create, update, delete and bulk record operations), on quote creation and on message sending. Every customer has its own separate database; automated tests check that an access token issued for one customer is rejected on a request made to another customer's web address.
Roles and sharingRecord visibility is controlled with role-based access and sharing rules; field-level hiding is supported.
Brute-force protectionLogin attempts are limited both per user and per IP address (10 attempts in 15 minutes), and two-factor authentication allows 5 attempts. The counters are kept atomically.
Rate limitingThe mechanism is in place: once a limit is exceeded the request is rejected with a 429 and a Retry-After header. Usage analytics show you how many requests each integration is making. We have no published fixed quota figure.
EncryptionBrowser connections to Rapitek CRM are redirected to HTTPS and encrypted with TLS; in our 23 September 2026 measurement TLS 1.3 and 1.2 were accepted and TLS 1.0 and 1.1 were refused. Passwords are not stored in plain text: they are hashed one-way with PBKDF2-SHA256 and cannot be reversed; API client secrets are stored as one-way hashes too. Email account OAuth tokens; WhatsApp Business, Instagram and Meta access tokens and webhook secrets; payment and İYS provider credentials; two-factor authentication secrets and backup codes; and voiceprints are encrypted at the application level before they are written to the database.
BackupsRapitek CRM database backups are taken automatically every six hours; each run checks that the dump completed without error and that the compressed file can be opened. Local copies on the server are retained for 30 days. The off-server copy sits in a separate country, Germany (Falkenstein): database backups sent since 2 September 2026, 03:11 Turkey time, are encrypted with OpenPGP before they leave the server, and the decryption key is not on the production server. Encrypted off-server backups are deleted automatically after 90 days. This 90-day period keeps the newest 28 copies of every database regardless of their age, so that the last copies are not deleted as well if backups stop or fail; as a result, the last 28 copies of the database of a customer whose account has been terminated are not deleted by this period, and today there is no separate step that deletes them. Files attached to a record (for example, CVs) are not deleted from storage (DigitalOcean Spaces, Frankfurt) whether you delete the file from the record card or delete the record; today the product does not delete these files by itself. To have them deleted, you need to write to our support team. Restores are verified through manual drills; the most recent drill was on 6 October 2026. We do not commit to any restore time.
Subprocessor: Cloudflare, Inc.Content delivery network, TLS termination, web application firewall and bot protection · the edge server nearest the visitor, company in the United States. It is in the path of every request and the TLS connection terminates at the edge rather than at the hosting server, so data in transit and the visitor's IP are processed at that layer. No content is stored there. The requests we measured went through EU edge nodes (Amsterdam from Turkey, Stockholm from Helsinki); the node is chosen by proximity to the visitor and is not fixed.
Subprocessor: HetznerApplication server and database · Helsinki, Finland (EU)
Subprocessor: Hetzner Storage BoxDatabase backups · Falkenstein, Germany (EU)
Subprocessor: DigitalOcean SpacesFiles and media you upload · Frankfurt, Germany (EU). Those attached to a record stay here whether you delete the file from the record card or delete the record; to have them deleted, write to our support team
Subprocessor: Amazon SESDelivery of system email · Frankfurt, Germany (EU)
Subprocessor: SentryApplication error monitoring · Germany (EU). Configured not to send personal data.
Subprocessor: Anthropic (Claude)The AI features (Rapi assistant, business card scanning, meeting analysis, WhatsApp/Instagram assistant, AI step in flows), only when you use them or enable them in an automation · United States: an Article 9 KVKK transfer
Subprocessor: Meta Platforms Ireland Ltd.WhatsApp Business and Instagram messaging, only if you connect those channels · Ireland, with onward transfer to the United States. Message content and the other party's number or account pass through Meta's infrastructure.

AI access trail

When a record is read through the Claude connector, or a write that returns the record is made, a trail is kept. The trail holds the user who did it, the name of the AI tool, an encrypted identifier of the AI session, the IDs of the records involved, the names of the fields used, and the result and time of the request. Rejected attempts leave a trail too. The trail does not hold field values, record names, search text, message or note contents, your IP address or browser details. Trails are kept for 90 days and then permanently deleted; your organization cannot change this period. If a legal hold applies, deletion is postponed. The trail can be seen by the user who made the request, their management chain and administrators who can view all records. A trail entry cannot be edited afterwards. When AI features are switched off, the Claude connector cannot read or write records.

Sessions in the mobile app

A user can be signed in to the mobile app on up to 5 devices at the same time. When a sixth device signs in, the session that has gone unused the longest is closed. When the password changes, sessions on all devices are closed. If your organization prefers, it can limit users to a single device; multiple devices is the default. The session record keeps a device ID generated by the app, the platform (iOS or Android), the times the session was opened, last used and closed, and the reason it was closed. It does not keep the device name, the device model or an IP address. A session that goes unused for 30 days becomes invalid.

Where the legal counterpart of this page lives

Every technical statement on this page has a legal counterpart, and we wrote those out one by one on separate pages.

The full list of parties that touch your data is in the subprocessor table above; who each transfer goes to, to which country, and on what legal basis is set out one by one in Sections 8 and 13 of our Privacy Policy. The obligations we take on contractually, and the limits of each one, are on the Terms of Service page. Our KVKK Privacy Notice covers the notice we give for data that reaches us through the forms on this site.

During an enterprise evaluation, the same team that builds the product fills in your security assessment forms; if you ask about something beyond this page, we answer it in writing.

What each plan covers, on one page

Three tiers, a scope table and separately priced items, with the numbers. Scope and any setup fee are worked out in the discovery call and shared in writing.

See pricing

We publish the figures rather than asking you to request them.

Frequently asked security questions.

Where exactly is our data kept?
In the European Union, in three locations: the database in Helsinki (Finland), the files and media you upload in Frankfurt (Germany), and database backups in Falkenstein (Germany). We have no component in Turkey and no region-selection feature. Seen from a company in Turkey this is a transfer abroad within the meaning of Article 9 of Law No. 6698; we establish the basis for that transfer together with you during the contract process and give you in writing which component sits in which country. The full list of parties that touch your data is in the subprocessor table on this page; the legal basis for each transfer is set out in Sections 8 and 13 of our Privacy Policy.
Do you claim GDPR compliance?
We do not make that claim: we hold no GDPR certification and have been through no external compliance audit. What we can state is concrete, and it is what a legal team usually asks first: where the data sits. Your database is in Helsinki (Finland), your files in Frankfurt (Germany), your backups in Falkenstein (Germany); all three are inside the European Union. Hosting and storage sit inside the EU; Anthropic (US), Cloudflare (a US company) and Meta (Ireland/US) do not. Anthropic applies only when you use an AI feature such as Rapi or enable one in an automation, Meta only if you connect WhatsApp or Instagram. The subprocessor table on this page names every party that touches your data and gives the country for each one, including outbound email through Amazon SES in the Frankfurt region.
Do you sign a data processing agreement (DPA)?
We do not publish a data processing agreement, and there is no DPA document on this site to download. We are not going to describe a document we have not written. What exists today is this: the contractual counterpart of everything on this page (who processes your data, in which country, and on what basis the transfer abroad is made) is drawn up with you during the contract process, and we put the details in writing during an enterprise evaluation. If your procurement process needs a signed data processing agreement before a technical evaluation can begin, raise it at the first call: it is a legal step, not a product setting, and it is better on the table from the start than discovered late.
Where does the Rapi AI assistant send our data?
AI features such as Rapi send content to Anthropic only when you use them or enable them in an automation; Rapi runs on AI credit that you top up separately, and an administrator can turn all AI features off with one switch under Setup › System Controls. When you use Rapi, the record content relevant to the question you ask is sent to Anthropic's Claude model in the United States, a second transfer abroad under Article 9 of KVKK, separate from the hosting in Finland, and one we state in our privacy notice. Anthropic commits not to use data sent through its API to train models.
Can another customer see our data?
Not your CRM records. Every customer runs in its own separate database; data is not filtered by company ID in a shared table. The application picks which customer's database a request goes to from the web address it arrives at; automated tests check that a token issued for one customer is rejected at another customer's web address. Against that, we make no claim of a separate server, customer-specific hardware or a customer-specific database password: what we state is separation at the database level. There is one exception and we state it explicitly: the application's technical error logs are kept in a single table shared by all customers, and an entry can contain personal data from the request that failed. Those logs are kept only for fault diagnosis; they are not your CRM content.
Can Rapitek staff reach our data?
Access to customer data is limited to authorised personnel. We do not say "nobody ever looks at your records". Here is what you should know: when an error occurs, the application writes the trace to an error log table shared by all customers, and that table can hold the user's email address, IP address and the body of the request; this is the place the support and debugging flow reads. Against that, the field changes users make to existing records inside the application are written to the audit trail, and you see that trail too. Operations run directly on the database are not written to this trail. During an enterprise evaluation we share our access policy in writing.
Can we see who changed what?
Partly. A separate history record is kept for every field change users make to an existing record: which user, when, the old value and the new value (for protected fields, only a marker instead of the values). The record's initial creation and some bulk updates the system makes in the background are not recorded. For record deletions, user and permission settings, automations and background processes, the recorded user may not be the person who actually made the change. The history is shown in the History tab on record screens and can be queried field by field from the API; an admin can set a retention period, but expired history rows are only marked as deleted and the old values stay in the database. Field history is on by default across every object that ships in a standard install.
Will you tell us if there is a data breach?
Yes. Our breach process is built on Law No. 6698: notification is made to the Turkish Personal Data Protection Board and to the individuals concerned within the period and in the manner that Law requires. Because you will have your own notification obligation as the data controller, you are informed without delay. Two limits, stated plainly: we do not give a contractual notification deadline of our own, and our process is not written against a second breach-notification regime in addition to Law No. 6698. If a fixed deadline or a particular regime is one of your procurement requirements, bring it to the call and we will tell you what we can commit to.
Do you hold a security certification?
No. We hold neither an ISO 27001 certificate nor a SOC 2 report, and we will not claim one until we have it. We do not use in-between phrases such as “we are in the certification process” or “we are compliant with the standards” either. If you have a requirement for a certified supplier, it is worth knowing that at the start of your evaluation. Against that, the same team that builds the product fills in your enterprise security assessment forms and walks through the architecture on a screen share.
Do you give a written uptime commitment?
No. We publish no uptime percentage. We give no written response-time commitment either. If a guaranteed service level is one of your requirements, let us talk about it at the start of the evaluation; every obligation we take on contractually, and the limits of each one, is written out on our Terms of Service page.
Have you had an independent penetration test?
We have no independent penetration test report, and we do not say we have had one done. With the organisations that ask for a security assessment, we go through that process together in a call.
Can a record deleted by mistake be recovered?
Deletion is soft: the record does not leave the database at once but moves to the recycle bin. You can restore from the recycle bin one by one or in bulk. Restoring is open to the owner with edit rights and to any user who can edit all records (admins included); which profiles have these rights depends on your setup. Records in the recycle bin are deleted automatically after 30 days. Consent and legal-evidence records, and records still linked to other records, are kept. An authorised user can permanently delete records from the bin; evidence and consent records are protected from permanent deletion. To have attached files and field history deleted, write to our support team; this cannot be undone, although copies remain in backups until those backups are deleted.
What happens to an employee's data when they leave?
Records belong to the company, not to the user. When a user account is closed, the records they created stay in place and can be reassigned to another owner; the account can no longer be used to sign in, its API and mobile access tokens are revoked, and the closure is recorded with its date in the user's change history; however, that history entry does not currently show who actually made the change.
Can we get our data whenever we want?
Yes. You can export your data in standard formats, and you can also pull it programmatically through our REST API, which reaches every record in the CRM. If you decide to leave, we charge no extra fee for data export; this is written into our Terms of Service.
Who answers support requests?
There is no call centre on our support line. Your question is answered by the team that builds and develops the product. This is a choice, not a matter of capacity. The same team fills in your enterprise security assessment forms and walks through the architecture on a screen share. We give no written response-time commitment.
Can you support our teams in other countries?
Support is provided during Turkish business hours. If you have teams in other time zones, let us discuss the scope together in a call.

Ask our team your security questions.

We fill in enterprise buyers' security assessment forms and walk through the architecture on a screen share. A technical conversation, not a sales call. Then we open your 7-day trial account; no credit card required.

Made with RapitekGO

We'd like to use optional measurement cookies; if you decline, the site works the same. Cookie policy