Legal
Data Processing Agreement
Standard terms · last updated 24 October 2026
01Roles
You are the data controller. CRM Anvil is the data processor, acting only on your documented instructions through your workspace settings and orders.
02Purpose of processing
Hosting and processing of your CRM records, including assessment, deduplication, normalisation, enrichment, consent reconciliation, migration and AI-assisted features you enable. Your data is never used for our own purposes.
03Security measures
TLS 1.2+ in transit, encryption at rest, tenant isolation, role-based access under least privilege, MFA for privileged users, secret storage separate from application data, and audit logging.
04Sub-processors
A short list of infrastructure, AI model and enrichment providers, disclosed on request and before any change. Each is bound by equivalent obligations.
05AI processing
AI features send only the minimum data needed for a requested task to the model provider. Customer data is not used to train general-purpose models, and AI features can be disabled per workspace.
06Breach notification
We notify you without undue delay and in any case within 48 hours of becoming aware of a personal data breach affecting your records, with the facts known at that point and the steps taken.
07Retention and deletion
Workspace data is retained according to your settings and deleted on termination. Staging copies, source files and connector credentials are deleted after the agreed retention period, with written confirmation on request.
08Audit and assistance
On request we provide the information needed to demonstrate compliance, and we assist with data subject requests relating to records we processed.
09Signature
We will sign this DPA on request, or review and sign yours instead. Write to info@crmanvil.com and we will send an executable copy.
Questions about this document: info@crmanvil.com