Privacy and Compliance

What happens to your data, what we do and don't do with it, and the standards KamoCRM is built to align with.

Your data is yours

The information your organization puts into KamoCRM belongs to your organization. It isn't sold, it isn't shared with other customers, and it isn't used to build products for anybody else.

GDPR

KamoCRM is built to align with GDPR, which matters whether or not you're in Europe — if any of your customers are, it applies to you.

In practice that means the things GDPR requires are possible rather than theoretical: a person's records can be found, exported and deleted; access to personal data is logged; and the separation between organizations is enforced in the data layer rather than by convention.

Health information

If your organization handles medical information, KamoCRM has a specific mode for it. Turning on PHI handling changes behavior across the product: access to patient records is audited individually, and clinical features become available.

It isn't a checkbox to try. What Turning On PHI Handling Does explains what changes before you change it, and The PHI Access Audit covers the trail it produces.

SOC 2

KamoCRM's controls are built in alignment with the SOC 2 framework — access control, change management, monitoring and incident response. If your procurement process needs formal documentation of current attestation status, ask through Getting Support; that's a question with a specific answer at a specific date, and this page isn't the right place to give it.

AI and your data

The AI Assistant answers from your own organization's data. Knowledge base articles are used to train it only when marked for it, and even then the audience rules on the article still apply — a team-only article is never quoted to a customer.

If your organization connects its own AI provider, your data goes to that provider under your agreement with them. AI Providers Explained covers what that means.

Asking a specific question

Compliance questions usually have a specific answer that depends on your industry, your country and your contract. A help center page can tell you how the platform is built; it can't tell you whether that satisfies your regulator. Ask, and get an answer you can put in front of them.