VODOO CRM
LoginFree trial

Security and data protection

The VODOO CRM database is hosted in the European Union (Ireland) and the application runs in Europe (Paris). Data is encrypted in transit (TLS 1.3) and at rest, each organization is isolated from the others by database-level access rules, and the credentials of your third-party services, such as Twilio, are encrypted with AES-256-GCM. VODOO CRM is GDPR-compliant.

Information taken from the privacy policy (version 1.2 of October 23, 2026).

Hosting and data location

  • Database and authentication: Supabase, hosted in the European Union (Ireland).
  • Application: Vercel, a US company, running in Europe (Paris), SOC 2 certified.
  • Reception of your contacts’ email replies and error monitoring (Sentry): hosted in the European Union.
  • Subprocessors based in the United States are covered by the European Commission’s standard contractual clauses and/or the EU-US Data Privacy Framework.

Security measures

  • Encryption of data in transit (TLS 1.3) and at rest.
  • Secure authentication with JWT session management.
  • Each organization isolated by database-level access rules (Supabase Row Level Security).
  • Credentials for your third-party services (Twilio, integrations) encrypted at rest with AES-256-GCM and never sent back to the browser.
  • Access to production data limited to authorized people.
  • Cloudflare Turnstile CAPTCHA on sign-in and sign-up forms, and request rate limiting against abuse.

Payments, texts and assistant

  • Payments: processed by Stripe, PCI-DSS Level 1 certified. VODOO CRM stores no card data.
  • Texts: sent and received through your own Twilio account, under your own contract with Twilio. VODOO CRM only uses the credentials you entrust to it, stored encrypted.
  • In-app assistant: Anthropic’s AI model receives your questions, never your CRM data.

Subprocessors

Each subprocessor is bound to VODOO CRM by a GDPR-compliant data processing agreement (DPA).

SubprocessorRoleLocation
SupabaseDatabase and authenticationEuropean Union (Ireland)
VercelApplication hostingUnited States, running in Paris
StripePayment and billingUnited States
ResendSending emails, open and click tracking, receiving repliesUnited States, reception in the EU
InngestBackground workflows and campaignsUnited States
SentryError monitoringEuropean Union
UpstashRequest rate limiting, abuse protectionUnited States
AnthropicAI model of the in-app assistantUnited States
CloudflareDNS and Turnstile CAPTCHAUnited States
Zoho MailReceiving emails sent to contact@vodoocrm.com—

Your data belongs to you

  • Export your data in a structured format (CSV, JSON), directly from your account settings.
  • Permanent deletion started by the account owner, without contacting us: Settings › General › Delete organization.
  • After cancellation: 30 days to export, then permanent deletion. Billing data kept 10 years (accounting obligation), security logs 12 months.
  • If a data breach is likely to create a risk to your rights: notification to the competent authority within 72 hours, and you are informed without undue delay if the risk is high.

Learn more