Three kinds of storage, holding three different sorts of thing.
Records
Anything with fields β leads, accounts, contacts, calendar events, timecards, settings β lives in a distributed SQL database. "Distributed" means it isn't one machine holding one copy: several machines each hold a copy of every record, and a write isn't considered done until enough of them agree.
That's what makes losing a machine survivable. The remaining copies serve reads immediately, and the missing copy is rebuilt in the background.
Files
Anything you upload β documents, images, recordings, marketing materials β goes into object storage, which is a system built for files rather than for rows. Files are stored in buckets and replicated across sites, so a file is not a single object on a single disk.
Files are never served directly from storage to a browser. A request comes through KamoCRM first, which checks that the person asking may have that file. A file's storage address is not a way around its permissions.
In-flight state
A few things are deliberately temporary: your signed-in session, a live call, an open chat window. These live in memory rather than on disk, and are meant to disappear β a session that survived forever would be a security problem, not a feature.
Backups
Records are backed up on a schedule, and the backups are stored separately from the running system. That covers the failure a replicated database doesn't: somebody deleting something they shouldn't have.
Replication protects against a machine dying. Backups protect against a mistake. They're different problems and they need different answers.
Data residency
If your organization has a legal requirement about which country your data sits in, that's a deployment question rather than a setting, and it needs a conversation. Getting Support is the way to start one.
Related articles
Other guides that answer questions close to this one.
How Your Data Is Encrypted
Encryption appears in three places, and they protect against three different things. In transit Everything between your browser and KamoCRM is encrypted with TLS β the same technology as the padlock in your address bar.β¦
Who Can See Your Data
The honest version, including the parts that are usually left out. Other customers: never Organizations are separated in the database itself. Every query is scoped to one organization before it runs, so there is noβ¦
Privacy and Compliance
What happens to your data, what we do and don't do with it, and the standards KamoCRM is built to align with. Your data is yours The information your organization puts into KamoCRM belongs to your organization. It isn'tβ¦