What's Crisp EU GDPR compliance status?
The European Union General Data Protection Regulation (GDPR) is a regulation that aims at unifying EU member state data privacy regulations into a single regulation, enforced on the EU single market. This article describes the GDPR compliance status of Crisp.
If your company needs to ensure it is GDPR-compliant, it also needs to ensure its providers (ie. Crisp) are also GDPR compliant. Crisp is GDPR-compliant, and strictly enforces the regulation as to protect the user data we store. The list of our providers (ie. Data Processors) is available, and kept up to date, in our Data Processing Agreement (DPA).
Are you looking for a Data Processing Agreement (DPA)? Read how to sign a DPA between your company and Crisp.
The GDPR regulation can be reduced to 12 important points. For each point, we explain how Crisp handles its compliance. If we did not answer your questions in this article, you can still contact us and drop us a chat or email.
Also, please note that all Crisp data processor providers have been checked to be all GDPR-compliant (Cloudflare, DigitalOcean, Stripe). See the DPA we provide for a full list of our providers.
Crisp is a French Company 🇫🇷. All Crisp data is held on servers hosted in the 🇪🇺 European Union. Our Messaging data is stored in 🇳🇱 The Netherlands and our Plugin data is stored in 🇩🇪 Germany. Servers are hosted by DigitalOcean (with a subsidiary in the EU subject to EU law).
We use relay servers outside EU to reduce latency for users connecting for terminals far from our EU servers. Those servers do not store any data except connection logs (IP address, date of connection, user-agent and source website). Those relay servers are hosted in 🇺🇸 The United States of America, United Kingdom 🇬🇧 and 🇸🇬 Singapore. We do not plan to store data outside the EU in the future.
Our products rely on other third-party services, owned, developed and operated by Crisp. Namely, Mirage for our AI features (eg. LiveTranslate, MagicReply, etc.), and Enrich for our data enrichment features (eg. automatic user avatars). We made the choice to build our own third-party services to protect the privacy of your end-users, instead of relying on services operated by other companies. This reduces the spread of our external data processors to a bare minimum.
Certain points of Crisp GDPR compliance are subject to the law of France, where Crisp is incorporated. Thus, we have to be compliant with French data protection law, as well as EU GDPR law. GDPR compliance and French law is applied worldwide.
All employees responsible of software development & infrastructure maintenance of Crisp IM SAS, a French limited company (the owner company for Crisp) are fully aware of the GDPR requirements.
Also, code reviews are performed by the Data Protection Officers (as listed in this article), before any code deployment to the platform. This ensures security breaches and bad practices are not implemented by eg. a third party temporary contractor or a Crisp employee, even if aware of GDPR requirements (this plays as a double human safety check).
You can check more about how we manage Crisp security internally on this article : How is security managed on Crisp services?
Crisp stores data on 2 kinds of parties:
Our customers (ie. the operators using the Crisp Dashboard replying to their users)
Our customers end-users (ie. the users of our customers)
Crisp does not share, or resell, any kind of user data (whether data described in point 1 or 2 above). The data is not used for advertising (both 1 and 2) or analytics (on 2). Our business model is solely based on paid subscriptions (ie. the user is not the product).
Crisp collects account information for each user (we refer to them as customers in this article), including:
User first and last name, and profile picture
User payment details (includes invoicing information, eg. company address and country — the credit card number is stored by Stripe)
We don't log user activity, except for system logs including IP, user agents and time of connection. They are solely used for debugging and lawful purpose and retained maximum 1 year. This log retention policy is subject to the law of France (ie. if the judiciary system sends us a search warrant, we have to respond and provide logs up to 1 year, that contain the looked up information).
Information held on our users' end-users include:
End-user email address (if provided by end-user, thus involving a consent)
End-user phone number (if provided by end-user, thus involving a consent)
End-user message exchanges
End-user last activity date and time
End-user profile information (resolved from public data shared by end-user on the Internet, see notice below)
Crisp resolves end-user identity information (first and last name, avatar, company) from external APIs. Those external APIs source this data from public information that the end-user consented to share on a third-party service (eg. on social networks such as LinkedIn or X). This end-user identity information is stored on Crisp services, for as long as the Crisp customer wishes them to be stored in their Crisp CRM database. The service used to discover such user information is Enrich, a service owned and operated by Crisp.
The information help on our users' end-users is solely the responsibility of our users (ie. the individual websites using Crisp). It is the responsibility of our users to manage the data they hold in their personal Crisp Inbox and CRM, ie. to remove sensitive data if someone may happen to share it with them (eg. Social Security Numbers, etc.). It is our responsibility to secure access to this data (ie. only website operators can access it and have a right to rectification and deletion).
Crisp customers and users privacy terms are clearly communicated in our Privacy information.
Crisp customers end-users privacy terms are the sole responsibility of Crisp customers. They should be announced on Crisp customers website.
Crisp customers rights regarding to GDPR are considered and enforced, including:
Right to be informed: we clearly inform our users about the use that will be made of their data
Right of access: our users can access all their data, without restriction, from the Crisp apps
Right of rectification: it's as simple as contacting us, we'll process all your rectification queries
Right of erasure: it's as simple as contacting us, we'll process all your erasure queries
Right to restrict processing: we don't process the data of our customers (and our customers end-users)
Right to data portability: our users may contact us anytime if they wish to get an export of their data (this may take time, however, as the data is fragmented amongst multiple isolated data-stores)
Right to object: we handle all requests on this matter from our users and users' end-users (contact us)
Right not to be subject to automated decision-making including profiling: we don't do that (and never will)
Crisp replies to all access requests (positively or negatively) under 1 week (the legal limit from GDPR is 1 month).
We offer this free of charge for our customers (paid and free).
Crisp stores user data involving a consent (ie. a conversation both parties entered by will, and exchanged eg. emails).
It is the Crisp customers responsibility to ensure user data is lawfully collected in the event they use our CRM feature. For instance, if the emails that get collected from the Crisp chatbox gets re-used for marketing campaign purposes either on Crisp or an external system, the Crisp customer has to ask for user consent upon collecting this email.
Consent is provided by our users explicitly when proceeding an action or task (eg. when they provide user data).
Crisp allows its customers to submit user data in an automated way, via a frontend JavaScript API and backend REST API, for instance assigning an email or avatar or name to a chatbox session, when the chatbox user is already identified to their customer website account. This data must have been provided by the customer user in a consented way, as it will get propagated to Crisp in an automatic way (if the customer implemented such API in their source code).
Crisp does not offer online services to children, due to the nature of the service provided (business-to-business). Thus, we did not identified it as relevant to control the age of users signing up for services.
Children might still be able to use the Crisp chatbox services, from the website or apps of a Crisp customer. To this extent, the Crisp customer is responsible for checking against their own users and activities regarding children regulations.
Our team closely monitors any unauthorized system access, and has put in place multiple preventive measures to reduce the attack surface on our systems and services. In 2 years, Crisp has had 0 major security issues, with only a few minor ones, which we fixed the same day they were reported (those would not have allowed a hack or data breach).
Security researchers and users can submit a security report to an encrypted email address (security@crisp.chat) as explained on our Security Practices docs page, for which we process reports in the same day. We also distribute bounties for valid security flaws that are reported to us. We already distributed such bounties to independent security researchers who reached to us and disclosed minor security flaws in a responsible way (ie. report was GPG/PGP-encrypted and not publicly disclosed before a fix was issued).
Here are a few measures we took to reduce any attack surface:
Aggressive use of firewalls and network isolation in our infrastructure
No access to our server systems is allowed from the public Internet, trusted administrators from the Crisp team need to connect via a trusted VPN network
We monitor any security flaw in any library we may use in our running backends, and patch them as soon as an update is issued
Use of 2-Factor-Authentication on all our sensitive accounts (eg. hosting provider, etc.)
Isolate data stores and sensitive backends on different servers
All platform backups are GPG/PGP-encrypted and stored privately, retained for a maximum of 1 week
The points listed above help reduce the probability of a major data breach occurring. You can read more on how Crisp manages security there.
Crisp will notify their users of any data breach, 24h maximum after knowing about it and fixing the flaw. It is then the responsibility of our users to report this data-breach to their end-users in due time.
Whenever Crisp develops a new system, security comes as a first when designing the architecture of such a system. Our first goal is to protect the integrity of the new production system, and second goal to protect the user data that's being stored and used by that system.
Crisp developers are well educated to software and network security, which helped us build a secure by design software over time.
Crisp designated a Data Protection Officer, as required by GDPR:
Role: Co-founder & CTO
Email: dpo@crisp.chat
Location: Crisp offices in France (see "International" below)
Note that, even as the DPO, Valerian is not answering to GDPR questions directly. Someone from our support team will answer to all your GDPR-related questions.
Crisp may, via its users, processes data from individuals from all over EU member states.
Crisp main establishment is France, thus its supervisory authority is based in France.
Crisp is operated by Crisp IM SAS, a French limited company, identified as:
ID / SIREN: 833085806
Address: 2 Boulevard de Launay, 44100 Nantes, France
Email: corp@crisp.chat
Phone: +33240031187
If your company needs to ensure it is GDPR-compliant, it also needs to ensure its providers (ie. Crisp) are also GDPR compliant. Crisp is GDPR-compliant, and strictly enforces the regulation as to protect the user data we store. The list of our providers (ie. Data Processors) is available, and kept up to date, in our Data Processing Agreement (DPA).
Are you looking for a Data Processing Agreement (DPA)? Read how to sign a DPA between your company and Crisp.
Crisp and GDPR (in 12 points)
The GDPR regulation can be reduced to 12 important points. For each point, we explain how Crisp handles its compliance. If we did not answer your questions in this article, you can still contact us and drop us a chat or email.
Also, please note that all Crisp data processor providers have been checked to be all GDPR-compliant (Cloudflare, DigitalOcean, Stripe). See the DPA we provide for a full list of our providers.
Crisp is a French Company 🇫🇷. All Crisp data is held on servers hosted in the 🇪🇺 European Union. Our Messaging data is stored in 🇳🇱 The Netherlands and our Plugin data is stored in 🇩🇪 Germany. Servers are hosted by DigitalOcean (with a subsidiary in the EU subject to EU law).
We use relay servers outside EU to reduce latency for users connecting for terminals far from our EU servers. Those servers do not store any data except connection logs (IP address, date of connection, user-agent and source website). Those relay servers are hosted in 🇺🇸 The United States of America, United Kingdom 🇬🇧 and 🇸🇬 Singapore. We do not plan to store data outside the EU in the future.
Our products rely on other third-party services, owned, developed and operated by Crisp. Namely, Mirage for our AI features (eg. LiveTranslate, MagicReply, etc.), and Enrich for our data enrichment features (eg. automatic user avatars). We made the choice to build our own third-party services to protect the privacy of your end-users, instead of relying on services operated by other companies. This reduces the spread of our external data processors to a bare minimum.
Certain points of Crisp GDPR compliance are subject to the law of France, where Crisp is incorporated. Thus, we have to be compliant with French data protection law, as well as EU GDPR law. GDPR compliance and French law is applied worldwide.
1. Awareness
All employees responsible of software development & infrastructure maintenance of Crisp IM SAS, a French limited company (the owner company for Crisp) are fully aware of the GDPR requirements.
Also, code reviews are performed by the Data Protection Officers (as listed in this article), before any code deployment to the platform. This ensures security breaches and bad practices are not implemented by eg. a third party temporary contractor or a Crisp employee, even if aware of GDPR requirements (this plays as a double human safety check).
You can check more about how we manage Crisp security internally on this article : How is security managed on Crisp services?
2. Information we hold
Crisp stores data on 2 kinds of parties:
Our customers (ie. the operators using the Crisp Dashboard replying to their users)
Our customers end-users (ie. the users of our customers)
Crisp does not share, or resell, any kind of user data (whether data described in point 1 or 2 above). The data is not used for advertising (both 1 and 2) or analytics (on 2). Our business model is solely based on paid subscriptions (ie. the user is not the product).
2.1. Information held on our users
Crisp collects account information for each user (we refer to them as customers in this article), including:
User first and last name, and profile picture
User payment details (includes invoicing information, eg. company address and country — the credit card number is stored by Stripe)
We don't log user activity, except for system logs including IP, user agents and time of connection. They are solely used for debugging and lawful purpose and retained maximum 1 year. This log retention policy is subject to the law of France (ie. if the judiciary system sends us a search warrant, we have to respond and provide logs up to 1 year, that contain the looked up information).
2.2. Information held on our users' end-users
Information held on our users' end-users include:
End-user email address (if provided by end-user, thus involving a consent)
End-user phone number (if provided by end-user, thus involving a consent)
End-user message exchanges
End-user last activity date and time
End-user profile information (resolved from public data shared by end-user on the Internet, see notice below)
Crisp resolves end-user identity information (first and last name, avatar, company) from external APIs. Those external APIs source this data from public information that the end-user consented to share on a third-party service (eg. on social networks such as LinkedIn or X). This end-user identity information is stored on Crisp services, for as long as the Crisp customer wishes them to be stored in their Crisp CRM database. The service used to discover such user information is Enrich, a service owned and operated by Crisp.
The information help on our users' end-users is solely the responsibility of our users (ie. the individual websites using Crisp). It is the responsibility of our users to manage the data they hold in their personal Crisp Inbox and CRM, ie. to remove sensitive data if someone may happen to share it with them (eg. Social Security Numbers, etc.). It is our responsibility to secure access to this data (ie. only website operators can access it and have a right to rectification and deletion).
3. Communicating privacy information
Crisp customers and users privacy terms are clearly communicated in our Privacy information.
Crisp customers end-users privacy terms are the sole responsibility of Crisp customers. They should be announced on Crisp customers website.
4. Individuals’ rights
Crisp customers rights regarding to GDPR are considered and enforced, including:
Right to be informed: we clearly inform our users about the use that will be made of their data
Right of access: our users can access all their data, without restriction, from the Crisp apps
Right of rectification: it's as simple as contacting us, we'll process all your rectification queries
Right of erasure: it's as simple as contacting us, we'll process all your erasure queries
Right to restrict processing: we don't process the data of our customers (and our customers end-users)
Right to data portability: our users may contact us anytime if they wish to get an export of their data (this may take time, however, as the data is fragmented amongst multiple isolated data-stores)
Right to object: we handle all requests on this matter from our users and users' end-users (contact us)
Right not to be subject to automated decision-making including profiling: we don't do that (and never will)
5. Subject access requests
Crisp replies to all access requests (positively or negatively) under 1 week (the legal limit from GDPR is 1 month).
We offer this free of charge for our customers (paid and free).
6. Lawful basis for processing personal data
Crisp stores user data involving a consent (ie. a conversation both parties entered by will, and exchanged eg. emails).
It is the Crisp customers responsibility to ensure user data is lawfully collected in the event they use our CRM feature. For instance, if the emails that get collected from the Crisp chatbox gets re-used for marketing campaign purposes either on Crisp or an external system, the Crisp customer has to ask for user consent upon collecting this email.
7. Consent
Consent is provided by our users explicitly when proceeding an action or task (eg. when they provide user data).
Crisp allows its customers to submit user data in an automated way, via a frontend JavaScript API and backend REST API, for instance assigning an email or avatar or name to a chatbox session, when the chatbox user is already identified to their customer website account. This data must have been provided by the customer user in a consented way, as it will get propagated to Crisp in an automatic way (if the customer implemented such API in their source code).
8. Children
Crisp does not offer online services to children, due to the nature of the service provided (business-to-business). Thus, we did not identified it as relevant to control the age of users signing up for services.
Children might still be able to use the Crisp chatbox services, from the website or apps of a Crisp customer. To this extent, the Crisp customer is responsible for checking against their own users and activities regarding children regulations.
9. Data breaches
Our team closely monitors any unauthorized system access, and has put in place multiple preventive measures to reduce the attack surface on our systems and services. In 2 years, Crisp has had 0 major security issues, with only a few minor ones, which we fixed the same day they were reported (those would not have allowed a hack or data breach).
Security researchers and users can submit a security report to an encrypted email address (security@crisp.chat) as explained on our Security Practices docs page, for which we process reports in the same day. We also distribute bounties for valid security flaws that are reported to us. We already distributed such bounties to independent security researchers who reached to us and disclosed minor security flaws in a responsible way (ie. report was GPG/PGP-encrypted and not publicly disclosed before a fix was issued).
Here are a few measures we took to reduce any attack surface:
Aggressive use of firewalls and network isolation in our infrastructure
No access to our server systems is allowed from the public Internet, trusted administrators from the Crisp team need to connect via a trusted VPN network
We monitor any security flaw in any library we may use in our running backends, and patch them as soon as an update is issued
Use of 2-Factor-Authentication on all our sensitive accounts (eg. hosting provider, etc.)
Isolate data stores and sensitive backends on different servers
All platform backups are GPG/PGP-encrypted and stored privately, retained for a maximum of 1 week
The points listed above help reduce the probability of a major data breach occurring. You can read more on how Crisp manages security there.
Crisp will notify their users of any data breach, 24h maximum after knowing about it and fixing the flaw. It is then the responsibility of our users to report this data-breach to their end-users in due time.
10. Data Protection by Design and Data Protection Impact Assessments
Whenever Crisp develops a new system, security comes as a first when designing the architecture of such a system. Our first goal is to protect the integrity of the new production system, and second goal to protect the user data that's being stored and used by that system.
Crisp developers are well educated to software and network security, which helped us build a secure by design software over time.
11. Data Protection Officers
Crisp designated a Data Protection Officer, as required by GDPR:
Valerian Saliou
Role: Co-founder & CTO
Email: dpo@crisp.chat
Location: Crisp offices in France (see "International" below)
Note that, even as the DPO, Valerian is not answering to GDPR questions directly. Someone from our support team will answer to all your GDPR-related questions.
12. International
Crisp may, via its users, processes data from individuals from all over EU member states.
Crisp main establishment is France, thus its supervisory authority is based in France.
Crisp is operated by Crisp IM SAS, a French limited company, identified as:
ID / SIREN: 833085806
Address: 2 Boulevard de Launay, 44100 Nantes, France
Email: corp@crisp.chat
Phone: +33240031187
Updated on: 28/10/2024
Thank you!