Security & compliance

Built in Europe. Designed for trust.

Sales data is sensitive. It contains customer conversations, deal economics, and strategic intent. We treat it accordingly — not as a liability to manage, but as a commitment we made when we started building.

Everything below reflects how Glass CRM works today, not a roadmap. If your security team has questions not answered here, contact us directly.

EU-hosted infrastructure

Glass CRM was built in the European Union and runs entirely on European servers. Your data never leaves the EU — not for processing, not for storage, not for AI inference.

  • All infrastructure hosted in EU data centres
  • No data transferred to US or third-country servers
  • Enterprise-grade encryption in transit and at rest

GDPR & EU AI Act compliance

We designed for compliance from day one, not as an afterthought. Our data handling practices are aligned with GDPR and the EU AI Act — the two most rigorous data protection frameworks in the world.

  • Full GDPR compliance — lawful basis, data minimisation, retention limits
  • EU AI Act compliant — no high-risk AI classification applied to personal data
  • Right to access, rectification, erasure, and portability honoured on request

Data isolation per workspace

Every customer workspace is fully isolated. Your methodology configuration, your CRM data, your Field Notes — none of it is shared across tenants or accessible to other customers.

  • Strict multi-tenant isolation at the database level
  • No cross-tenant data access under any circumstances
  • Workspace data deleted on account closure upon request

Your data never trains AI models

This is a hard line. Your sales data, your methodology, your client conversations — none of it is used to train public AI models, fine-tune foundation models, or improve any system outside your workspace.

  • AI processing uses enterprise API boundaries with no training data retention
  • Your Playbook configuration is never shared or benchmarked externally
  • Raw Field Notes and audio are processed and discarded — not stored long-term

Human approval before CRM writes

Glass CRM never writes to your Salesforce org without a human in the loop. Field Notes structures and classifies data first — the rep reviews, edits, and approves before anything is pushed.

  • No automated CRM writes — every sync requires explicit rep approval
  • Draft data visible only to the rep until committed
  • Full audit trail of what was changed and when

Salesforce OAuth — read-only by default

The Salesforce connection uses OAuth 2.0. We read live CRM data to surface context — we do not store a copy of your Salesforce records, and write permissions are scoped only to what Field Notes needs.

  • OAuth 2.0 — no passwords stored, tokens scoped and revocable
  • CRM records read live, never cached or duplicated in our database
  • Write scope limited to fields explicitly mapped in your Playbook

Questions for your security team?

We are happy to complete security questionnaires, provide additional documentation, or arrange a technical call with your IT or legal team. We would rather answer every question up front than have security be a reason a good deal stalls.