How Recovizy protects your CRM data

Where your data is hosted

The Recovizy database runs in Ireland, inside the European Union. The site and the application are served by a host whose server functions run in Dublin.

You accept a data processing agreement (GDPR) in the application before your first import; the acceptance is recorded with its date.

How Recovizy reaches your contacts

Your contacts arrive in one of three ways: a CRM you connect in one click (HubSpot, Pipedrive), a file you export from any other tool (CSV, Excel, Google Sheets), or, on quote, a direct connection to your database. In every case Recovizy reads your contacts and writes nothing to your tools without your validation.

• A read-only account: you create a dedicated user on your own database, with the right to read and nothing else.
• Proof in the report: Recovizy attempts one write, which your own server refuses, inside an operation that is cancelled at once. The "Audit data" report shows that refusal.
• An encrypted connection: the link to your database is encrypted (TLS), and the connection is refused if encryption is not available.

A direct connection to a database is read-only, and three mechanisms guarantee it.

What is encrypted

Contacts themselves are not encrypted field by field: the application has to sort, deduplicate and score them. They are protected by storage encryption and by the isolation between accounts described below.

Isolation between customers

Each account can read and change only its own data. The rule is applied by the database itself (row-level security), not only by the application: a request sent straight to the database is filtered in the same way.

• Every table is protected, and any new table is protected automatically.
• Sensitive operations, such as activating a subscription, can only be run by the server.
• Recorded recovery events cannot be edited or deleted afterwards.

Accounts and payments

• Passwords found in known data breaches are refused.
• Application pages require a signed-in session.
• Card details are entered on the payment provider's page. Recovizy never sees or stores them.
• The site cannot be displayed inside another site's frame, which blocks clickjacking.

Who else processes your data

AI requests go through a control layer: only approved services can be called, and the log keeps a fingerprint of each request, not its text.

Your data is never sold and is not used to train models. No advertising or third-party analytics tool is loaded by the site: its audience is measured by Recovizy itself.

How long data is kept

• When you delete your account, your imported contacts and everything derived from them (deals, duplicates, history) are deleted with it.
• Contact backups you create are deleted automatically after 30 days.
• For an audit without a subscription, the imported contacts are deleted automatically 30 days after you generate the report.
• AI request logs are deleted automatically after 90 days.
• You can ask for your data to be deleted at any time, through the contact page.

What this page does not claim

Recovizy does not hold an ISO 27001 or SOC 2 certification, and this page is not one. It describes the measures in place on the date shown above. Security questionnaires from your IT team are welcome through the contact page.

Frequently asked questions