Who really holds your customer list?

We looked inside twenty CRM systems to answer one question for UK businesses: if you want your customer data under UK control, can you actually get it? The answer is more tangled — and more interesting — than any sales brochure will tell you.

---

Your CRM — the system that holds your customer list — is one of the most sensitive pieces of software your business runs. It knows who your customers are, what they’ve bought, what they’re about to buy, every email you’ve sent them and every complaint they’ve made. If you care at all about where that information lives and who could, in principle, get access to it, the CRM is the place to start asking.

So we asked. We took twenty CRM products — American, British, Irish, Belgian, Norwegian, Estonian, Israeli and Indian — and traced, from each company’s own published documents, four things that sound like one thing but aren’t: who owns the company, where your data is stored, whose computers it actually runs on — and who the product is actually built for, because a sole trader and a 5,000-person enterprise are not choosing from the same shelf.

Here is the short version: not one of the twenty gives a UK business a simple, fully British answer — though the twentieth comes closest, by a curious route. And the brands you’d guess to be the most British are some of the most surprising.

Four questions hiding inside one

When a buyer asks “is this CRM okay from a UK data point of view?”, they are really asking four separate questions, and each can have a different answer for the same product.

1. Who owns the company? This decides which country’s courts and governments ultimately have leverage over it — and ownership moves around more than people think. Pipedrive feels like a friendly Estonian success story; it has been majority-owned by a US private equity firm since 2020. Really Simple Systems was a Hampshire-built CRM used by the British Museum; in 2023 it was bought by a Dutch group backed by Rotterdam private equity, and renamed Spotler CRM. SuperOffice spent thirty years as a Norwegian family firm; it’s now held by Danish private equity, with a US asset manager as the anchor investor since last year. The label on the tin tells you where the company started, not who controls it today.

2. Where is the data stored? This is the question vendors answer most readily — and it produces the strangest results of our eleven. Capsule, a genuinely British-owned CRM run from Manchester, stores its customers’ data in the United States, on Amazon’s cloud. Meanwhile, American-owned Pipedrive now puts new UK customers’ data in London by default. The British company keeps your data in America; the American-owned one keeps it in Britain.

3. Whose computers does it run on? Almost no CRM company runs its own machines. Nine of our eleven sit on someone else’s cloud — overwhelmingly Amazon, Microsoft or Google, all American. This matters because of a piece of US law worth knowing by name: the CLOUD Act. In plain terms, it means US authorities can lawfully require American companies to hand over data in their possession wherever in the world it is stored. A “UK data centre” that is operated by a US company is not the same thing as data beyond US reach. So Pipedrive’s London region is a real benefit — your data doesn’t cross borders day to day — but it is London-on-Amazon, and the same logic applies to every vendor renting space from the big three.

4. Who else touches the data? Every modern CRM quietly relies on a supporting cast: companies that deliver its emails, route its phone calls, and — increasingly — supply the artificial intelligence behind its “write this email for me” buttons. This is where even the careful answers come apart. SuperOffice keeps its core servers in Norway with a Norwegian hosting firm — but every document its customers upload goes to Microsoft’s cloud in the Netherlands and Ireland, and its bulk email runs through a US provider. The front door is Norwegian; the filing cabinet is Microsoft’s.

The twenty, at a glance

CRM	Owned from	Aimed at	UK customer data sits in	Runs on	AI features use
Salesforce [1]	USA (listed)	All sizes	UK available (core CRM) — but Marketing Cloud has no UK option	Own data centres + Amazon	OpenAI, Microsoft, Google, Anthropic
Microsoft Dynamics 365 [2]	USA (listed)	Small to enterprise	UK region available	Microsoft end-to-end	Microsoft’s own AI service
HubSpot [3]	USA (listed)	All sizes	No UK option — typically Germany	Amazon only	OpenAI, Amazon, Google
monday CRM [4]	Israel (listed)	All sizes	US/EU/Australia — no UK	Amazon + Google	OpenAI, Anthropic, Microsoft
Freshsales (Freshworks) [5]	USA (listed; Indian-born)	All sizes	US/EU/India/Australia — no UK	Amazon only	Own “Freddy” AI layer
SugarCRM [6]	USA (private equity)	Mid-market	UK available (London)	Amazon	Rebranding around AI; suppliers not detailed
Pipedrive [7]	USA (private equity; Estonian-born)	Small & mid-size	UK (London) — new UK default	Amazon only	OpenAI
Insightly [8]	USA (private equity, via Canadian group)	Small & mid-size	Not disclosed	Amazon + Google	OpenAI, Anthropic
Zoho CRM [9]	India (family-owned)	All sizes	Netherlands + Ireland (no UK site)	Its own servers	Building its own; OpenAI optional
Bigin (Zoho) [9]	India (family-owned)	Micro businesses (1–20 people)	Netherlands + Ireland	Zoho’s own servers	Zoho’s own
Odoo [10]	Belgium (founder-controlled)	All sizes	France/Belgium (no UK) — or host it yourself	OVHcloud (French) + Google	n/a (self-host possible)
Efficy [11]	Belgium (founders + European PE)	All sizes	“Hosted in Europe” — provider not named publicly	Undisclosed	Not disclosed
Salesflare [12]	Belgium (founder-owned)	Small businesses	Belgium, on Google	Google	Not disclosed
SuperOffice [13]	Denmark/USA investors (Norwegian-born)	Mid-market	Norway — but documents go to Microsoft (NL/IE)	Norwegian host + Microsoft	Microsoft AI services
OnePageCRM [14]	Ireland (founder-owned)	Small businesses	Data transferred to the USA	Amazon	Not stated
Attio [15]	UK (venture-backed, London)	Startups & small teams	Region not disclosed	Google only	Not disclosed
Workbooks [16]	UK (founder-led, British minority investor)	Mid-market	UK, on its own equipment	Own servers in Equinix (US-owned) UK buildings	Provider not stated
Capsule [17]	UK (founder-led, Manchester)	Small businesses	USA, on Amazon	Amazon only	OpenAI
Spotler CRM [18]	Netherlands (Dutch PE; British-born)	Small businesses	Belgium, on Google	Google + Amazon	Not disclosed
SuiteCRM (open source) [19]	UK (Stirling — team-owned)	Micro to enterprise	Your choice — self-host anywhere, or its hosted service with a UK region	Self-host: yours. Hosted: its own Scottish private cloud or Amazon	n/a

Every row of that table contains at least one wrinkle a buyer wouldn’t guess from the homepage.

Size changes everything

The “aimed at” column matters more than it looks, because it decides which compromises are even available to you. Capsule is a good example: it is genuinely British-owned, but it is built for small businesses — its own pricing pages cap each plan at 30,000 to 120,000 contacts and describe the tiers in one-to-five-employee and “scaling teams” terms, with none of the access-control machinery a big organisation needs. A large enterprise with many thousands of customers was never its market.

That creates an awkward asymmetry for UK buyers. Small businesses have British-owned options (Capsule, Attio) — but their data often lives abroad anyway, and the small-business tier of the market discloses least about its AI suppliers. Mid-market companies get the single most sovereign option on the list, Workbooks — UK-owned, UK-hosted, on its own equipment. Large enterprises have almost no UK-owned choice: at that end the realistic menu is American (Salesforce, Microsoft, HubSpot), Israeli (monday.com), Indian (Zoho), or Belgian (Odoo, Efficy) — so for big UK organisations, sovereignty is mostly about configuration (UK regions, your own encryption keys, AI switches) rather than ownership. The one exception is an unusual one, and it gets its own story below.

Three stories worth a closer look

The most British option still has American walls. Workbooks, a founder-led company in Reading, is the closest thing to a sovereign choice on the list: it runs the service on its own equipment, in the UK, and says customer data stays here. But the buildings its equipment sits in are operated by Equinix — a Californian, Nasdaq-listed data-centre company. Its email-sync feature is built and run by a third party, and its new AI assistant doesn’t say whose AI models sit underneath. None of this makes Workbooks a bad choice — it may be the best fit for a sovereignty-minded buyer — but even the best case is layered, not pure.

One product, two different answers. Buy Salesforce’s core CRM in the UK and you can keep your data in a UK region (run on Amazon’s cloud). Add Salesforce’s marketing product and the picture changes completely: Marketing Cloud has no UK home at all — your campaign data lives in the US, France, Germany or on Google’s machines — and Salesforce’s own documents say that after a serious incident in Europe, data is restored in the United States. Two products, one logo, opposite answers. Buyers who clear “Salesforce” as a single decision miss this entirely.

The most self-sufficient vendor isn’t Western at all. Zoho is the only company of the eleven that states plainly it owns its whole stack — its own servers, its own encryption keys, no Amazon, Microsoft or Google underneath, and an in-house AI model on the way so it never has to send your data to OpenAI (today that’s an optional, switched-off-by-default feature). For data-locality purists it’s a striking offer. But Zoho is an Indian family-owned company, its European data centres are in Amsterdam and Dublin — a promised UK site hasn’t materialised — and “we own everything” means your alternatives if you fall out with them are precisely none. Self-sufficiency and sovereignty are related, but they are not the same word.

The most sovereign option is a free fork of an American product. SuiteCRM was born in Scotland in 2013, when a Stirling consultancy took the last open-source edition of SugarCRM — after SugarCRM walked away from open source — and kept building it. The code is fully open (anyone can read it, run it, or take it elsewhere), a UK company stewards it, and a UK buyer can self-host it on any infrastructure they choose: the strongest data-location position in this whole cohort, available from a free download. It even comes with a real-world stress test. In early 2025 the original company behind it went into liquidation — and the product simply carried on, under a new Stirling company run by the project’s long-time technical lead. For every other vendor on our list, the failure of the company is the failure of the product; here, the open licence meant it wasn’t. That’s what open source buys in sovereignty terms: not just where the software runs, but whether it survives its owner. The fine print is equally honest: self-hosting means you carry the patching, backups and security yourself (or pay a UK partner to), the hosted version uses Amazon for some regions, and the stewarding company is barely a year old. Control of your destiny, it turns out, comes with the maintenance schedule attached. The same distinction applies to Belgium’s Odoo — and it’s worth remembering that self-hosting a proprietary product (which SugarCRM itself still allows) buys only the location half: your data on your servers, but software that still lives and dies with its American owner.

One more warning from the wider field: “open source” on the label doesn’t always mean it. We checked four other CRMs that market themselves that way, and two turned out to be only partly open on inspection — one (Twenty [21], a fast-rising American “open alternative to Salesforce”) keeps its enterprise features under a proprietary licence, and another (Poland’s YetiForce [22]) has quietly moved its recent versions onto restricted terms while the homepage still says “open source without restrictions”. The survival guarantee only covers what the licence actually frees. If open source is part of your reason for choosing a product, read the licence, not the homepage — of everything we examined, only SuiteCRM, Odoo’s community edition and the charity-sector specialist CiviCRM [20] are fully open, and SuiteCRM remains the only one stewarded from the UK.

What a UK buyer can actually do

You cannot buy your way to a perfectly British CRM today — the option doesn’t exist at any realistic price. What you can do is know exactly which compromises you’re making. Six questions will get you most of the way, and a vendor’s willingness to answer them crisply is itself a useful signal (one of our twenty markets itself on European hosting but declines to name, publicly, whose data centres it uses):

1. Who ultimately owns you — and in which country? Not the brand: the owner, today.
2. Where exactly will my data be stored, and can I choose? Get the city, in writing.
3. Whose cloud does that location actually run on? “UK data centre” is the start of the answer, not the end.
4. When your AI features run, whose AI is doing the work, and where? Can I switch it off?
5. Which other companies touch my data — email delivery, phone calls, support tools — and where are they? Ask for the published list; serious vendors maintain one.
6. If you’re acquired, what happens to my data and my contract? Six of our twenty changed hands in the last six years — including, in its own way, the open-source one. It’s not a hypothetical.

The honest conclusion is that sovereignty, for a UK business choosing a CRM, is not a yes/no purchase — it’s a dial. You can turn it a long way up (self-hosting, or a UK vendor on its own equipment) at a real cost in convenience and features. You can leave it low with your eyes open (a US suite, with your encryption keys under your own control where that’s offered — Microsoft currently offers the strongest version of that). What you can’t sensibly do anymore is assume the flag on the website tells you where your customer list actually lives. It almost never does. And there’s a fitting irony to where the search for the most sovereign CRM ends: at a free, Scottish-stewarded fork of an American product — kept alive not by any company, but by a licence no one can revoke.

---

Sources

All facts are taken from each vendor’s own published documentation (security, data-location and sub-processor pages) and from company registries, read directly during June 2026. One reference per vendor.

1. Salesforce — SEC filings: https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001108524&type=10-K ; infrastructure/sub-processors: https://www.salesforce.com/content/dam/web/en_us/www/documents/legal/misc/salesforce-infrastructure-and-subprocessors.pdf
2. Microsoft (Dynamics 365) — SEC 10-K: https://www.sec.gov/Archives/edgar/data/789019/000095017025100235/msft-20250630.htm ; data residency: https://learn.microsoft.com/en-us/microsoft-365/enterprise/m365-dr-overview
3. HubSpot — SEC filings: https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&company=hubspot&type=10-K ; hosting/sub-processors: https://knowledge.hubspot.com/account-security/hubspot-cloud-infrastructure-and-data-hosting-frequently-asked-questions ; https://legal.hubspot.com/sub-processors-page
4. monday.com — SEC 20-F: https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001845338&type=20-F ; sub-processors: https://monday.com/l/privacy/sub-processors-subsidiaries-support/
5. Freshworks (Freshsales) — SEC filings: https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&company=freshworks&type=10-K ; sub-processors: https://www.freshworks.com/privacy/sub-processor/
6. SugarCRM — ownership (Accel-KKR): https://www.accel-kkr.com/sugarcrm-partners-with-private-equity-firm-accel-kkr-for-next-phase-of-accelerated-growth/
7. Pipedrive — ownership (Vista, 2020): https://tech.eu/2020/11/12/pipedrive-unicorn/ ; data/security: https://support.pipedrive.com/en/article/how-secure-is-my-data-in-pipedrive ; sub-processors: https://www.pipedrive.com/en/subprocessors
8. Insightly — ownership (Crest Rock): https://www.crestrockpartners.com/news/insightly ; sub-processors: https://www.insightly.com/subprocessors/
9. Zoho (Zoho CRM, Bigin) — Companies House PSC: https://find-and-update.company-information.service.gov.uk/company/13424508/persons-with-significant-control ; data centres: https://help.zoho.com/portal/en/kb/accounts/manage-your-zoho-account/articles/data-center-for-zoho-account ; privacy: https://www.zoho.com/privacy-commitment.html
10. Odoo — privacy / hosting (OVHcloud, France/Belgium): https://www.odoo.com/privacy
11. Efficy — ownership (Seven2 PE): https://www.seven2.eu/en/entrepreneur/efficy/
12. Salesflare — ownership/terms: https://salesflare.com/terms ; data location: https://howto.salesflare.com/en/articles/955593-where-is-my-data-stored
13. SuperOffice — ownership: https://www.superoffice.com/news/press-release/accelerate-european-growth/ ; sub-processors: https://www.superoffice.com/trust-center/agreements/sub-processors/
14. OnePageCRM — ownership/terms: https://www.onepagecrm.com/terms/ ; security: https://www.onepagecrm.com/security-2/
15. Attio — Companies House PSC: https://find-and-update.company-information.service.gov.uk/company/10719702/persons-with-significant-control ; compliance/hosting: https://attio.com/legal/compliance
16. Workbooks — Companies House PSC: https://find-and-update.company-information.service.gov.uk/company/16783483/persons-with-significant-control ; sub-processors: https://www.workbooks.com/wp-content/uploads/sub-processors-policy.pdf
17. Capsule (Zestia Ltd) — Companies House PSC: https://find-and-update.company-information.service.gov.uk/company/06418281/persons-with-significant-control ; sub-processors/data: https://capsulecrm.com/dpa/subprocessors/
18. Spotler CRM (Spotler Group; formerly Really Simple Systems) — ownership: https://spotlergroup.com/blog/spotler-group-raises-e30-million-to-accelerate-growth ; data security: https://support.reallysimplesystems.com/cloud-crm-data-security/
19. SuiteCRM (SuiteCRM Ltd) — Companies House: https://find-and-update.company-information.service.gov.uk/company/SC824064 ; hosted/data region: https://suitecrm.com/suitecrmhosted/
20. CiviCRM — about/governance: https://civicrm.org/about ; data processing: https://civicrm.com/civicrm-spark-data-processing-agreement/
21. Twenty — licence/privacy: https://twenty.com/legal/privacy
22. YetiForce — Polish company register (KRS): https://api-krs.ms.gov.pl/api/krs/OdpisAktualny/0000940956?rejestr=P&format=json

---

Research notes: all facts in this article were taken from the vendors’ own published documentation — security pages, data-location documents and lists of supporting providers — and from company registries, read directly during June 2026. Data locations and supplier lists change; check the vendor’s current documents before relying on them. This article reflects the opinions of the Information Matters team — human and AI — and should not be considered statements of fact. Please feel free to contact us if you would to suggest any corrections.