Security and GDPR

Servers in Germany

Inside the EU, in a Hetzner data centre

Encrypted connections

Panel, apps and API over HTTPS only

No card data stored

Payments are taken by PayTR

Official WhatsApp API

Connected through Meta's official Cloud API

Where is your data kept?

Our application servers run in Germany (Hetzner) and our database in a European data centre (MongoDB Atlas). Both are subject to the EU's data protection rules (GDPR).
Every connection between the panel, the mobile and desktop apps and the API is encrypted with HTTPS.

Account security

Passwords are stored in a form that cannot be reversed (bcrypt); nobody, our team included, can see your password.
Two-step verification with an authenticator app, email or Telegram.
Every sign-in is recorded. The sign-up and sign-in pages are protected against bots (Cloudflare Turnstile).

Team and permissions

Each teammate sees only the sections, chats, leads and sales you allow.
If you have several WhatsApp lines, you can limit each person to their own lines.
Customer phone numbers can be hidden from staff; staff activity is recorded.

Integration secrets are locked

Connection details such as email account passwords are stored encrypted with AES-256. A copy of the database alone is not enough to read them.

AI connections (ChatGPT, Claude)

ChatGPT, Claude and other AI assistants connect to iri CRM with OAuth; your password or API key is never shared.
You choose which tools to allow and can cut the connection at any time. The AI tools cannot delete any record.

Contracts and consent forms

Digital contracts and consent forms are signed with a code sent to the customer's phone; who signed and when is recorded.

KVKK and GDPR

You are the data controller for your customers' data; iri CRM processes it on your behalf as a service provider (data processor).
We sign a data processing agreement (DPA) with businesses that ask for one.
You can close your account from the panel; it can be reopened within 30 days. To get a copy of your data or have it deleted, just write to us.

Frequently asked

Is my data kept in the EU?

Yes. Our servers are in Germany and our database is in a European data centre; both are subject to the EU's data protection rules (GDPR). We sign a data processing agreement if you ask for one.

Can the iri CRM team see my customer data?

We process your data only to run the service and for the support you ask for. Your password is stored in a form that cannot be reversed and integration secrets are encrypted.

Do you sign a data processing agreement (DPA)?

Yes, with any business that asks. Write to [email protected].

What happens if I close my account?

You close the account from the panel and can reopen it within 30 days. To get a copy of your data or have it deleted, write to [email protected].

Need a DPA or have a question?

Write to us. For details see our privacy policy.

[email protected]

Your data is safe, and you stay in control