You know where your data lives.

In the European Union, in three locations: the database in Helsinki (Finland), the files and media you upload in Frankfurt (Germany), and database backups in Falkenstein (Germany). We have no component in Turkey and no region-selection feature. Seen from a company in Turkey this is a transfer abroad within the meaning of Article 9 of Law No. 6698; we establish the basis for that transfer together with you during the contract process and give you in writing which component sits in which country. The full list of parties that touch your data is in the subprocessor table on this page; the legal basis for each transfer is set out in Sections 8 and 13 of our Privacy Policy.

We do not make that claim, because we have not measured it: we hold no GDPR certification and have been through no external compliance audit. What we can state is concrete, and it is what a legal team usually asks first — where the data sits. Your database is in Helsinki (Finland), your files in Frankfurt (Germany), your backups in Falkenstein (Germany); all three are inside the European Union. Hosting and storage sit inside the EU; Anthropic (US), Cloudflare (a US company) and Meta (Ireland/US) do not. Anthropic applies only if you enable Rapi, Meta only if you connect WhatsApp or Instagram. The subprocessor table on this page names every party that touches your data and gives the country for each one, including outbound email through Amazon SES in the Frankfurt region.

We do not publish a data processing agreement, and there is no DPA document on this site to download. We are not going to describe a document we have not written. What exists today is this: the contractual counterpart of everything on this page — who processes your data, in which country, and on what basis the transfer abroad is made — is drawn up with you during the contract process, and we put the details in writing during an enterprise evaluation. If your procurement process needs a signed data processing agreement before a technical evaluation can begin, raise it at the first call: it is a legal step, not a product setting, and it is better on the table from the start than discovered late.

Rapi is off by default; to use it you have to top up credit on your account separately. Until you do, none of your CRM data is sent to any AI provider. Once you enable Rapi, the record content relevant to the question you ask is sent to Anthropic's Claude model in the United States — a second transfer abroad under Article 9 of KVKK, separate from the hosting in Finland, and one we state in our privacy notice. Anthropic commits not to use data sent through its API to train models.

Not your CRM records. Every customer runs in its own separate database; data is not filtered by company ID in a shared table. The application picks which customer's database a request goes to from the web address it arrives at; automated tests check that a token issued for one customer is rejected at another customer's web address. Against that, we make no claim of a separate server, customer-specific hardware or a customer-specific database password: what we state is separation at the database level. There is one exception and we state it explicitly: the application's technical error logs are kept in a single table shared by all customers, and an entry can contain personal data from the request that failed. Those logs are kept only for fault diagnosis; they are not your CRM content.

Access to customer data is limited to authorised personnel. We do not say "nobody ever looks at your records" — we have not measured that, and we do not commit to something we have not measured. Here is what we did measure: when an error occurs, the application writes the trace to an error log table shared by all customers, and that table can hold the user's email address, IP address and the body of the request; this is the place the support and debugging flow reads. Against that, the field changes users make to existing records inside the application are written to the audit trail, and you see that trail too. Operations run directly on the database are not written to this trail. During an enterprise evaluation we share our access policy in writing.

Partly. A separate history record is kept for every field change users make to an existing record: which user, when, the old value and the new value (for protected fields, only a marker instead of the values). The record's initial creation and some bulk updates the system makes in the background are not recorded. For record deletions, user and permission settings, automations and background processes, the recorded user may not be the person who actually made the change. The history is shown in the History tab on record screens and can be queried field by field from the API; an admin can set a retention period, but expired history rows are only marked as deleted and the old values stay in the database. Field history is on by default across every object that ships in a standard install.

Yes. Our breach process is built on Law No. 6698: notification is made to the Turkish Personal Data Protection Board and to the individuals concerned within the period and in the manner that Law requires. Because you will have your own notification obligation as the data controller, you are informed without delay. Two limits, stated plainly: we do not give a contractual notification deadline of our own, and our process is not written against a second breach-notification regime in addition to Law No. 6698. If a fixed deadline or a particular regime is one of your procurement requirements, bring it to the call and we will tell you what we can commit to.

No. We hold neither an ISO 27001 certificate nor a SOC 2 report — and we will not claim one until we have it. We do not use in-between phrases such as “we are in the certification process” or “we are compliant with the standards” either. If you have a requirement for a certified supplier, it is worth knowing that at the start of your evaluation. Against that, the same team that builds the product fills in your enterprise security assessment forms and walks through the architecture on a screen share.

No. We publish no uptime percentage; we do not measure uptime with an independent external monitoring service, and we do not publish a figure we have not measured. We give no written response-time commitment either. If a guaranteed service level is one of your requirements, let us talk about it at the start of the evaluation; every obligation we take on contractually, and the limits of each one, is written out on our Terms of Service page.

We have no independent penetration test report, and we do not say we have had one done. With the organisations that ask for a security assessment, we go through that process together in a call.

Deletion is soft: the record does not leave the database at once but moves to the recycle bin, from where it can be restored one at a time; bulk restore does not work today. Restoring is open to the owner with edit rights and to any user who can edit all records (admins included); which profiles have these rights depends on your setup. The automatic clean-up that should permanently delete records from the bin after 30 days has never run, so records deleted over 30 days ago are still there. An authorised user can permanently delete records from the bin; evidence and consent records are protected from permanent deletion. To have attached files and field history deleted, write to our support team; this cannot be undone, although copies remain in backups until those backups are deleted.

Records belong to the company, not to the user. When a user account is closed, the records they created stay in place and can be reassigned to another owner; the account can no longer be used to sign in, its API and mobile access tokens are revoked, and the closure is recorded with its date in the user's change history; however, that history entry does not currently show who actually made the change.

Yes. You can export your data in standard formats, and you can also pull it programmatically through our REST API, which covers the 183 business objects that ship in a standard install. If you decide to leave, we charge no extra fee for data export; this is written into our Terms of Service.

There is no call centre on our support line. Your question is answered by the team that builds and develops the product — this is a choice, not a matter of capacity. The same team fills in your enterprise security assessment forms and walks through the architecture on a screen share. We give no written response-time commitment.

Support is provided during Turkish business hours. If you have teams in other time zones, let us discuss the scope together in a call.