Try the demo Start free trial
Trust centre

Your customer data, handled properly.

We store your data in the UK, encrypt the parts that matter most, and never sell it. This page tells you exactly how, in plain English.

Where your data lives

🇬🇧
UK hosted
The CRM, its database and its backups are stored in UK data centres. Some providers you connect, such as Retell and Postmark, process data in the USA or EU. They are all listed below.
🔒
Encrypted where it matters
Passwords are hashed. API keys, email passwords and connection tokens are encrypted with AES-256. Backups are encrypted before they are stored.
🛡️
Encrypted in transit
All traffic between your browser, our servers and our subprocessors runs over HTTPS, with HSTS so browsers never fall back to an insecure connection.
📋
Nightly encrypted backups
A full database backup every night, encrypted with AES-256 and kept outside the public web folder for 14 days.

GDPR posture

We act as your data processor for customer records you store in the CRM. You are the data controller. Our processing is governed by our Data Processing Agreement, which admins can read and sign inside the CRM under Your data and GDPR.

  • Lawful basis: we process your data only to deliver the service you subscribe to.
  • Data portability: export your contacts to CSV at any time. Ask and we send a full export within 48 hours.
  • Right to erasure: ask us to close your account and we delete your data from the live system within 30 days. Backups roll off after 14 days.
  • Subprocessor notice: we notify you of any new subprocessor 30 days before it processes your data.
  • Breach notification: we notify you within 72 hours of any personal data breach affecting your records.
  • DPA: admins can read and sign our Data Processing Agreement inside the CRM, and the signed copy is kept on your account. You can also read it here.

Subprocessors

These are the third-party services we use to deliver the CRM. Each is contractually bound to protect your data to the same standard we do.

ProviderPurposeRegion
TwilioSMS delivery, phone numbersUK / EU
Retell AIAI receptionist and outbound AI callsUSA
StripeSubscription billingUK / EU
PayPalCustomer payment processingUK / EU
PostmarkEmail deliveryUS / EU
AnthropicAI content generation, KB synthesisUS (data not retained)
Postcodes.io (Ideal Postcodes)Travel time and route mileage, postcode only. From 11 November 2026UK / EU

Last updated 26 September 2026. We notify all customers by email at least 30 days before adding a new subprocessor.

Operational security

Two-factor auth
Available for every user account. Required for owner and admin roles.
Session controls
Idle sessions sign out after 30 minutes. Secure, HTTP-only session cookies.
Audit log
Every write action is logged with actor, target and timestamp. Exportable to CSV.
Role-based access
Five system roles plus custom roles with granular wildcard permissions.

Security updates

What we improved this month, and what is coming next. We update this list every month.

Done in September 2026
  • Every request is now checked so one company can never see or change another company's records.
  • API keys, email passwords and connection tokens are encrypted with AES-256.
  • Nightly encrypted database backups, kept outside the public web folder for 14 days.
  • Old data exports and logs moved out of the public web folder.
  • Old test and debug scripts removed from the server.
  • Signed one-click unsubscribe links on every marketing email.
  • Bounces and spam complaints now stop further emails to that address automatically.
  • Incoming webhooks (WooCommerce, website forms) must carry a valid signature.
  • Marketing emails and service emails now send separately, so one never affects the other.
  • Hourly health check on the automation engine, with an alert if it stops.
Done so far in October 2026
  • Two-step sign-in is now required for every owner and admin account.
  • Each business can read and sign our data processing agreement inside the CRM, and see where its data is kept.
  • Every page now carries a security token, so forms cannot be submitted on your behalf by another site.
  • Search results are cleaned before they are shown, closing off a possible script injection route.
  • Each connected website gets its own signed webhook secret, and unsigned order updates are rejected.
  • Hourly health checks on every connection, with an alert to your admins if one fails for more than two hours.
  • A daily self-test of the platform, reported to our team every morning.
  • If your session expires, the CRM now tells you clearly instead of appearing to save.
Coming in October 2026
  • Fresh keys for the remaining scheduled sync jobs.
  • A monthly restore test of the nightly backup, so we know it works when you need it.

Reporting security concerns

Found a vulnerability? Please email info@unavoidablecrm.com. We respond within one business day.

System status Product changelog