Security and data

This English text is a translation for convenience. If it differs from the Uzbek text, the Uzbek text prevails.

This page explains in plain words how Fast-CRM stores and protects your data. It is not a contract: our obligations are in the Public offer, the Data processing annex and the Licence agreement. It describes only what actually works today.

1. Where your data is

• Fast-CRM Cloud runs on Contabo GmbH servers in Germany (European Union).
• Each customer's data is kept separate: on every request the system fetches only your workspace's data.
• Need the data on your own server? Choose the on-premise edition (section 6).

2. Backups

• The database is backed up every day, and the backup is kept on the server for 7 days.
• Each copy is encrypted with the age tool before it leaves the server and is kept elsewhere ([off-site backup provider]) for up to 35 days. The key that opens the copies is not kept on the server.
• If a disaster happens, the Service is restored from these copies.

3. Encryption

• All traffic between your browser and our servers is encrypted with HTTPS/TLS. Certificates renew automatically.
• Integration keys and tokens (Telegram bots, API keys, SSO and AI keys) are stored in the database encrypted with AES-256-GCM.
• Passwords are stored only as a bcrypt hash (an irreversible one-way code). Nobody, including us, knows your password.
• Off-site backups are encrypted (section 2).

4. Who sees what

• Roles: owner, administrator, manager, employee, observer, and roles you create yourself.
• Field-level permissions: for example, an employee may be unable to see a client's phone number or to change a price.
• Record access rules: for example, a manager sees only the deals assigned to them.
• Two-factor authentication: a password plus a one-time code from an authenticator app. An administrator can make it mandatory for everyone.
• SSO (single sign-on): through Google, Microsoft or another OIDC provider.
• Sessions: see active sessions and close sessions on other devices.
• Login history and audit log: who signed in, when, from which IP address, and what they changed.
• API keys: each key can be restricted to allowed IP addresses.
• Our staff: enter your workspace only for support or security. Each such entry is recorded in the audit log.

5. Take your data with you at any time

• Download each list as CSV, Excel (XLSX), TSV or JSON.
• The owner or an administrator downloads the whole workspace as one ZIP archive.
• Even if payment is late, the system does not shut down suddenly: after 7 days it switches to read-only mode, and viewing and export keep working.
• After you leave, the data is deleted within 30 days (export works until then) and disappears from the backups within a further 35 days.

6. On your own server (on-premise)

• You can install Fast-CRM on your own servers, for example in a data centre in Uzbekistan. The data never leaves you.
• We cannot access your data. We access it for support only if you allow it.
• Even when the licence term ends, the system does not shut down; it switches to read-only mode.
• Face recognition and face-based attendance are switched off in the cloud and work only in this edition: biometric data must be stored in Uzbekistan (to be verified).
• For closed networks with no internet access, a licence key without online checking is issued.

7. Artificial intelligence (Fast AI)

• Fast AI is off by default. An administrator turns it on.
• You choose the AI provider and connect it with your own key: for example, Anthropic or any OpenAI-compatible service. The provider uses the data under its own terms.
• You are responsible for making the transfer of data to the provider's country lawful and for informing your customers (ZRU-1115, to be verified). We recommend providers in states that Uzbekistan recognises as protecting data adequately.
• We do not use your data to train AI models.

8. If an incident happens

• We tell you within 24 hours about a security breach affecting your data: what happened, which data was affected and what we did.
• We help you send the notices the law requires to the authorised body, and we perform our own obligations ourselves.

9. Contact

• Security questions and vulnerability reports: info@fastcrm.uz, phone [phone].
• If you find a vulnerability, do not exploit it; write to us (Terms of use, clause 3.2).