Your data is safe with us

All data is hosted on IONOS servers located in the European Union. Your customer data never leaves EU jurisdiction, helping you meet GDPR territorial requirements.

Every connection to illmCRM is encrypted with TLS 1.3. Passwords are hashed using bcrypt (cost factor 12). API tokens are signed with HS256 JWTs and expire automatically.

Automated PostgreSQL backups run daily at 02:00 UTC. Dumps are gzip-compressed and uploaded to S3-compatible storage. Daily backups are retained for 30 days; weekly snapshots for 90 days.

Any tenant administrator can download a full CSV export of all their CRM data — contacts, accounts, deals, leads, and users — at any time via the Settings page. No lock-in, no delays.

Connect illmCRM to Zapier, Make, Slack, or any HTTP endpoint using our outbound webhook system. All payloads are HMAC-SHA256 signed so you can verify authenticity at the receiving end.

Role-based access control (admin, manager, user) is enforced at the API layer. Short-lived JWTs with silent refresh limit the blast radius of a compromised token.

Security-relevant actions — including data exports, session invalidations, and webhook registrations — are recorded in tamper-evident audit logs stored in the same transactional database.

We take vulnerability reports seriously. If you discover a security issue, please email us directly — we commit to acknowledging reports within 48 hours and issuing fixes for critical issues within 7 days.