Skip to main content

​
Data residency and international transfers

Twenty Cloud runs on AWS servers located in Frankfurt, Germany.
Hosting region selection will be available starting in 2027, initially for new workspaces. Users will be able to request a region change for an existing workspace at a later date. Alternatively, you can reach out to our Partners to help you set up your instance.
A list of all sub-processors is available in our Trust Center.
EU Standard Contractual Clauses, together with the UK Addendum and Swiss amendments, apply to international transfers of data outside the EU, including transfers to all sub-processors.
You can generate your signed DPA at https:///settings/legal/dpa (e.g. https://getting-started.twenty.com/settings/legal/dpa).
Yes. The standard DPA is available on every plan and can be signed in one click from Settings → Legal → DPA. Changes to the standard terms, such as a different contracting entity or custom notification deadlines, are available on the Enterprise plan.
As per our Privacy Policy, Twenty acts as the data processor for merchant and contact information stored in the CRM, while your company remains the data controller.
No. Twenty does not have its own AI model and does not train any model on your data. The AI providers used by default on Twenty Cloud (Azure OpenAI, OpenAI, Anthropic and Mistral) do not train on it under their terms. Some optional models, such as Google Gemini, and TypeSafe (used by the workflow Classify action) are only used if an admin enables them; their terms are listed in our Trust Center.
No data is sent to an AI provider unless someone in your workspace runs AI: the AI chat, an AI agent, or an AI step in a workflow. To block AI entirely, set a workspace AI usage limit of 0 in Settings → Billing, which applies to every member, admins included. You can also remove the Ask AI permission from your editable roles in Settings → Roles; the built-in Admin role always keeps it.

​
Security and access controls

All data is encrypted in transit and at rest. Tenant data is isolated through a schema-per-tenant setup, and encryption keys are periodically rotated.
Twenty’s engineering and support teams may access customer workspaces to investigate and resolve issues. Workspace owners control this: support access can be disabled at any time in Settings → General → Security, and it stays off until you turn it back on. Support access requires two-factor authentication on Twenty’s side, and on the Organization plan and above each session is recorded in your audit logs. While someone from Twenty is impersonating you, the session also appears with an Impersonation label in Settings → Profile → Devices.
Members whose role has the Impersonate permission can view the workspace as any other member, including workspace admins, so only grant it to roles you trust. You control who has this permission in Settings → Roles.
Audit logs are available on the Organization plan and above. You can set how long they are kept in Settings → General → Security.
In the event of a confirmed personal data breach affecting your data, we will notify you without undue delay, targeting no later than 72 hours from verification of the incident, as set out in section 4.6 of our DPA. Our notification will include, to the extent known at the time: the nature of the breach, the categories and approximate volume of data and individuals affected, likely consequences, and the remediation and mitigation measures taken or planned. We will provide updates as the investigation progresses.

​
Data retention and deletion

When a record is deleted, it is first soft-deleted and can still be restored. It is permanently deleted and removed from active systems once the retention period elapses or a user manually destroys it.
By default, soft-deleted records are kept for 14 days, after which they are permanently removed from the system. The retention period for soft-deleted records can be changed in Settings → General → Security.
A removed record remains in backups for 30 days, after which it is permanently deleted.
When a workspace is deleted, its data is removed from live systems within approximately 90 days of service termination, and usually much sooner. Back-up and archival copies are then overwritten or purged within a further 90 days, after which all data is permanently deleted. Throughout both periods the data is isolated from any operational use. On request, we can provide written certification once the purge is complete. See clause 4.9 of your Data Processing Agreement for the full terms.
Yes, during any backup-retention period, deleted data is isolated from operational use.
We acknowledge erasure requests and provide written confirmation once deletion is complete.

​
Backups and resilience

Backups are created continuously with snapshots taken daily, and the retention period is 30 days.
RTO and RPO are both 6 hours (as per our DPA).
All backups are encrypted and stored in geographically separate locations within the same jurisdiction (e.g. within EU for EU data).

​
Compliance

Yes, Twenty is GDPR compliant.
Yes, Twenty is SOC 2 compliant.
No, Twenty is in the process of becoming HIPAA compliant.

​
Licensing

No. Running a modified version for your own team is not distribution, so no publication obligation arises. The AGPL’s network clause applies when people outside your organization interact with your modified instance over the network.
No. Your front end is your own, separate work, and talking to Twenty through its APIs does not change that. Since Twenty itself is unmodified, there is nothing to publish.
Yes, since you’re modifying code to distribute it to others, you’re required to publish those changes. If you don’t want to publish your changes, you can obtain Organization license.
Applications that only interact with Twenty via its published APIs/SDKs can be licensed under terms of your choice (see the “Twenty Application Exception” in the repository LICENSE). Twenty itself is mostly AGPLv3, and some packages (including the Twenty SDK) are MIT licensed.
If you have more questions, please check our Terms and Conditions, Privacy Policy and Trust Center. If your questions are still unanswered, send them to contact@twenty.com or via support chat.