Security & Sovereignty
Sovereign by Design. Secure by Default.
Upra is a European CRM built for organisations that need control over their data: EU hosting, GDPR by design, an AI stack we operate end to end on European cloud, and isolation enforced where it matters — in the database.
EU hosting and data residency
Upra runs in the European Union. Customer data is stored and processed in EU data centres; Enterprise customers can choose a specific region, a private cloud or an on-premise deployment.
Our own AI stack on European cloud
By default, AI features run on models Upra manages on European cloud infrastructure (Scaleway, France), so the content you process stays in the EU. Only public web-search queries used for research and enrichment go to our search provider. Customers can also bring their own model with their own API key.
Tenant isolation at the database layer
Every workspace is isolated at the database level, not just in application code. Isolation is enforced by the data layer and tested in continuous integration on every release.
Encryption everywhere
TLS 1.2+ in transit, AES-256 at rest, encrypted backups with tested restore procedures and a disaster-recovery plan.
Access control
Role-based permissions down to the field, multi-factor authentication, SSO (Google, Microsoft, SAML for Enterprise), session controls and audit logs of every sensitive action.
GDPR by design
Data-subject rights (access, export, rectification, deletion) are product features. Consent, retention and deletion are configurable per workspace. A Data Processing Agreement is available on request.
Governed AI
Agents run under explicit permissions, an audit log and a spend budget. Every proposal is explainable — which conversation, which signal, which data — and the human confirms before anything changes.
Transparency
Sub-processors are listed below and updated when they change. Security incidents affecting personal data are notified to customers without undue delay, in line with GDPR.
GDPR in practice
For the customer data you manage in Upra, you are the data controller and Upra is the data processor. Upra processes that data only on your instructions, as described in the Privacy Policy and the Data Processing Agreement.
- Data residency: European Union. Enterprise customers can require a specific region or deployment model.
- Rights of data subjects: export, rectification and deletion are available to you directly in the product for any record.
- Retention: you decide how long records are kept; on termination, your data is exported on request and then deleted.
- Sub-processors: listed below. We notify customers before adding a sub-processor that handles personal data.
- Incident response: personal-data breaches are notified to affected customers without undue delay so they can meet their own obligations.
- DPA: request it at support@upra.ai.
Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Scaleway SAS | Website and application hosting, databases, backups | France (EU) |
| Scaleway SAS | AI model inference (Upra-managed models on European cloud) | France (EU) |
| Scaleway SAS (Transactional Email) | Transactional email delivery | France (EU) |
| Mollie B.V. | Payment processing | Netherlands (EU) |
| Exa Labs, Inc. | Web search for AI research and company/contact enrichment (search queries only) | United States (Standard Contractual Clauses) |
Selection criteria and the 30-day change-notification process are described on the Sub-processors page.
Responsible disclosure
If you believe you have found a security vulnerability in Upra, please report it to support@upra.ai. We acknowledge reports within two business days and do not take legal action against good-faith research that respects users’ data and availability.
Certifications
Upra is built to ISO 27001 practices and is working towards certification. Enterprise customers can request our security documentation and the results of independent penetration tests under NDA.
Need private cloud or on-premise?
Enterprise deployments run on your infrastructure with a one-command install, a dedicated Upranaut and a full-service migration.