Who really holds your customer list?

We looked inside the full audited field of CRM software sold to UK businesses — fifty-three companies, fifty-six products — to answer one question: if you want your customer data under UK control, can you actually get it? The answer is more tangled, and more interesting, than any sales brochure will tell you — and several of the names you’d assume are British keep your data somewhere else.

Your CRM — the system that holds your customer list — is one of the most sensitive pieces of software your business runs. It knows who your customers are, what they’ve bought, what they’re about to buy, every email you’ve sent them and every complaint they’ve made. If you care at all about where that information lives and who could, in principle, get access to it, the CRM is the place to start asking.

So we asked. This is a refresh of [our first look at CRM sovereignty](2026-06-12-crm-sovereignty-case-study.md), widened from the original twenty products to the full audited cohort: American, British, Irish, Belgian, Norwegian-by-origin, Danish, Estonian-by-origin, Israeli, Indian, Dutch, French, Polish and one Canadian. For every one we traced, from each company’s own published documents, four things that sound like one thing but aren’t: who owns the company, where your data is stored, whose computers it actually runs on — and who else touches the data, including which artificial-intelligence suppliers sit behind the “write this email for me” buttons.

Here is the short version: not one vendor in the field gives a UK business a simple, fully British answer — though a free, Scottish-stewarded open-source product comes closest, by a curious route. And the brands you’d guess to be the most British are some of the most surprising: three genuinely UK-owned charity and community CRMs keep their data outside the UK, while an American-owned product puts new UK customers’ data in London by default.

Four questions hiding inside one

When a buyer asks “is this CRM okay from a UK data point of view?”, they are really asking four separate questions, and each can have a different answer for the same product.

1. Who owns the company? This decides which country’s courts and governments ultimately have leverage over it — and ownership moves around more than people think. Pipedrive feels like a friendly Estonian success story; it has been majority-owned by a US private-equity firm, Vista Equity Partners, since 2020, and that has not changed. SuperOffice spent thirty years as a Norwegian firm; it is now held by Danish private equity — and as recently as June 2025 it passed into a fresh Axcel-managed continuation fund. Really Simple Systems, a Hampshire-built CRM, is now Spotler CRM, ultimately controlled from The Hague in the Netherlands. The label on the tin tells you where the company started, not who controls it today.

2. Where is the data stored? This is the question vendors answer most readily — and it produces the strangest results. Capsule, a British-controlled CRM run from Manchester, stores its customers’ data in the United States, on Amazon’s cloud. ToucanTech (British, London) keeps its data in the EU; Donorfy (British-owned, part of the Access Group) keeps charity data in Dublin. Meanwhile, American-owned Pipedrive now puts UK and wider-EMEA customers’ data in London. The British companies keep your data abroad; the American-owned one keeps it in Britain.

3. Whose computers does it run on? Almost no CRM company runs its own machines. The overwhelming majority sit on someone else’s cloud — Amazon, Microsoft or Google, all American. This matters because of a piece of US law worth knowing by name: the CLOUD Act. In plain terms, it means US authorities can lawfully require American companies to hand over data in their possession wherever in the world it is stored. A “UK data centre” that is operated by a US company is not the same thing as data beyond US reach. So Pipedrive’s London region is a real benefit — your data doesn’t cross borders day to day — but it is London-on-Amazon, and the same logic applies to every vendor renting space from the big three.

4. Who else touches the data? Every modern CRM quietly relies on a supporting cast: companies that deliver its emails, route its phone calls, and — increasingly — supply the artificial intelligence behind its assistant features. This is where even the careful answers come apart. SuperOffice keeps its core database in Norway with a Norwegian hosting firm (Visma) — but every document its customers upload goes to Microsoft’s Azure cloud in the Netherlands and Ireland, and its AI features run on Microsoft Azure too. The front door is Norwegian; the filing cabinet is Microsoft’s.

The field, at a glance

This is the full audited cohort. “Owned from” is the ultimate controller’s domicile (where a private-equity owner sits, that is the entry), verified against Companies House persons-with-significant-control filings, registry records, or the vendor’s own corporate record. “UK data lives” is where a UK customer’s records physically sit, from each vendor’s own data-location or sub-processor documentation; “not disclosed” means the vendor does not say in a free, public source we could read this June — it is an honest gap, not a guess. Where a product is self-hosted open source, the data sits wherever the customer chooses to run it.

Product	Owned from	Aimed at	UK data lives	Runs on	AI inside
Salesforce (Sales & Service Cloud) [1]	USA (listed)	All sizes	UK region available (AWS London)	Amazon (Hyperforce)	OpenAI, Anthropic, Google, Azure OpenAI (via Einstein)
Microsoft Dynamics 365 [2]	USA (listed)	Mid to enterprise	UK region available	Microsoft end-to-end	Microsoft (Azure OpenAI / Copilot)
HubSpot [3]	USA (listed)	Small to mid-market	No UK option — defaults to Germany	Amazon (+ Google, Snowflake)	OpenAI, Amazon, Google
monday CRM [4]	Israel (listed)	All sizes	No UK — US/EU/AUS/APAC	Amazon + Google	OpenAI, Anthropic, Amazon, Google, Microsoft
Freshsales (Freshworks) [5]	USA (listed; Indian-founded)	Small to mid-market	No UK — defaults to EU	Amazon only	Azure OpenAI + own “Freddy”
SugarCRM / “SugarAI” [6]	USA (private equity)	Mid-market	UK region available (AWS)	Amazon	Not disclosed
Pipedrive [7]	USA (private equity; Estonian-born)	Small & mid-size	UK (London) — EMEA default	Amazon only	OpenAI
Insightly [8]	USA (private equity)	Small & mid-size	USA (no UK/EU region)	Amazon	Not disclosed
Zoho CRM [9]	India (family-owned)	All sizes	Netherlands + Ireland (no UK site)	Its own data centres	Building its own (“Zia”)
Bigin (Zoho) [9]	India (family-owned)	Micro businesses	Netherlands + Ireland	Zoho’s own	Zoho’s own
Odoo CRM [10]	Belgium (founder-controlled)	All sizes	France/Belgium (no UK) — or self-host	OVHcloud (French) + Google	Not disclosed
Efficy CRM [11]	Belgium (private equity)	Mid-market	“European Union” — no detail	Not disclosed	Not disclosed
Salesflare [12]	Belgium (founder-owned)	Small B2B	Belgium (St Ghislain)	Google	Not disclosed
SuperOffice [13]	Denmark (private equity; Norwegian-born)	Mid-market	Norway core; documents to Microsoft (NL/IE)	Norwegian host (Visma) + Microsoft Azure	Microsoft Azure
OnePageCRM [14]	Ireland (founder-owned)	Small businesses	Transferred to the USA	Amazon	Not disclosed
Attio [15]	UK (venture-backed, London)	Startups & small teams	Not disclosed (may leave UK/EEA)	Not disclosed (gated)	“AI providers” (unnamed)
Workbooks [16]	UK (BGF-backed since Dec 2025)	Mid-market	UK (Equinix UK) + AWS Germany/UK	Equinix UK + Amazon	Not disclosed
Capsule (Zestia) [17]	UK (Manchester; founders + UK investor)	Small businesses	USA, on Amazon	Amazon only	OpenAI
Spotler CRM [18]	Netherlands (private equity; British-born)	Small businesses	Belgium, on Google	Google + Amazon	Not disclosed
SuiteCRM [19]	UK (Stirling — founder-controlled)	Micro to enterprise	Your choice — self-host anywhere	Self-host: yours. Hosted: own cloud or AWS	Not disclosed
Blackbaud (Raiser’s Edge NXT) [20]	USA (listed)	Nonprofits	Not disclosed (gated)	Not disclosed (gated)	Not disclosed
Beacon [21]	UK (founder-led)	Charities	UK (Smart Bcc via AWS Ireland)	Amazon + Google	“Beacon AI” (unnamed)
Access Donorfy [22]	UK (Access Group)	Charities	Ireland (Azure Dublin)	Microsoft Azure	Not disclosed
donorflex [23]	UK (founder-led MBO)	UK charities	Not disclosed	Not disclosed	None (no profiling)
Charitylog [24]	UK (Noveva Software Group)	Charities	UK	Amazon (UK)	Not disclosed
Spektrix [25]	UK (Norland Capital majority)	Arts & culture	EEA primary; UK for DR/reporting (Azure)	Microsoft Azure	Not disclosed
Tessitura [26]	USA (member cooperative)	Arts & culture	Not disclosed (gated)	Amazon	Not disclosed
iMIS (ASI) [27]	USA (private equity)	Associations	UK region (Azure, region-preserving)	Microsoft Azure	Not disclosed
Silverbear [28]	USA (ClearCourse/Aquiline)	Associations	UK/Europe/US (“or any country”)	Microsoft Dynamics + Azure	Not disclosed
ToucanTech [29]	UK (founder-led)	Alumni & community	EU, not UK (AWS)	Amazon (EU)	Third-party AI (unnamed)
White Fuse [30]	UK (founder-led)	Charities	Not disclosed (on request)	Not disclosed	Not disclosed
ChurchSuite [31]	UK (founder-led)	Churches	UK	Amazon (UK)	Not disclosed
EspoCRM / Cloud [32]	USA (founder-led)	All sizes	UK option (via 20i) — nearest DC	OVHcloud, Hetzner, 20i	Not disclosed
CiviCRM [33]	USA (founder-led, open source)	Nonprofits	Your choice (self-host)	Self-host: yours	Not disclosed
Twenty [34]	USA (venture-backed, open-core)	Startups & small teams	Frankfurt (EU) — or self-host	Amazon	Not disclosed
YetiForce [35]	Poland (listed)	SMEs	Your choice (self-host)	Self-host: yours	Not disclosed
Firefish [36]	UK (founder + Foresight VCTs)	Recruitment agencies	EU only — Azure (NL + IE)	Microsoft Azure	Own AI features (EU AI Act-built)
Vincere [37]	UK (Access Group)	Recruitment agencies	UK option (AWS London) — multi-region	Amazon (AWS)	Not disclosed
itris X [38]	UK (private equity)	Recruitment agencies	UK (Azure UK)	Microsoft Azure (UK)	Own AI (“itris AI”)
Street.co.uk [39]	UK (founder-controlled)	Estate agents	Not disclosed	Not disclosed	Not disclosed
iamproperty [40]	UK (private equity / founders)	Estate agents	Not disclosed	Not disclosed	Not disclosed
Twenty7tec (FINPLAN) [41]	UK (BGF-backed)	Mortgage advisers	Not disclosed	Not disclosed	Not disclosed
Axonaut [42]	France (founder-led)	French SMEs	France (Scaleway/Online)	Scaleway (French)	Not disclosed

Every row contains at least one wrinkle a buyer wouldn’t guess from the homepage. We have shown the most widely sold and most sovereignty-relevant products in full; a number of the niche recruitment, property and finance-vertical CRMs (Firefish, Vincere, itris, Street, iamproperty, Twenty7tec) are UK-controlled but publish no data-residency or cloud detail in a free, public source — which is itself a finding, and one we return to below.

Size changes everything

The “aimed at” column matters more than it looks, because it decides which compromises are even available to you. Capsule is a good example: it is British-controlled, but it is built for small businesses, and it stores customer data in the United States. A large enterprise with many thousands of customers was never its market.

That creates an awkward asymmetry for UK buyers. Small businesses have British-controlled options (Capsule, Attio, Beacon, ChurchSuite) — but where the data lives varies wildly: Capsule keeps it in America, Attio doesn’t say, while Beacon and ChurchSuite keep it in the UK. Mid-market companies get the single most sovereign mainstream option, Workbooks — UK-owned and, on its own sub-processor documentation, holding UK customer data in the UK (in Equinix-operated buildings, with some data in AWS Germany/UK). Large enterprises have almost no UK-owned choice: at that end the realistic menu is American (Salesforce, Microsoft, HubSpot), Israeli (monday.com), Indian (Zoho) or Belgian (Odoo) — so for big UK organisations, sovereignty is mostly about configuration (UK regions, your own encryption keys, AI switches) rather than ownership. The one exception is an unusual one, and it gets its own story below.

There is also a whole tier of UK-built sector specialists — for charities, arts venues, churches, estate agents, recruiters and membership bodies — where ownership is reliably British but disclosure is thin. The charity field alone shows the full spread: Charitylog, Beacon and ChurchSuite keep data in the UK and say so plainly; Donorfy (British-owned) keeps it in Dublin; ToucanTech keeps it in the EU; and White Fuse, donorflex, Spektrix, Firefish and several others simply don’t publish where the data sits. A British owner is not, on this evidence, a reliable proxy for British data.

Stories worth a closer look

The most British mid-market option keeps the data in Britain — but the buildings are American-run, and the owner just changed. Workbooks, a company in Reading, is the closest thing to a sovereign mainstream choice: its sub-processor documentation puts UK customer data in the UK (with some in AWS Germany and the UK), and its core infrastructure sits in data centres operated by Equinix. Two caveats. Equinix is a Californian, Nasdaq-listed data-centre company, so even the UK buildings are US-operated. And the ownership shifted in December 2025: Companies House records show the founder ceased to be the majority controller and BGF — the UK Business Growth Fund — became a person with significant control. Workbooks remains UK-controlled (British founder, UK investor), but it is no longer simply “founder-owned.” None of this makes it a bad choice; it may be the best fit for a sovereignty-minded buyer. But even the best case is layered, not pure.

One product, two different answers. Buy Salesforce’s core CRM in the UK and you can keep your data in a UK region, run on Amazon’s cloud (Salesforce calls its infrastructure Hyperforce). Add Salesforce’s marketing product and the picture changes completely: Marketing Cloud has historically had no UK home, and the AI behind Salesforce’s assistant features draws on a roster of American suppliers — OpenAI, Anthropic, Google and Microsoft’s Azure OpenAI — routed through its “Einstein Trust Layer.” Two products, one logo, different answers. Buyers who clear “Salesforce” as a single decision miss this.

The most self-sufficient vendor isn’t Western at all. Zoho is the only company in the field that states plainly it owns its whole stack — its own data centres, no Amazon, Microsoft or Google underneath, and an in-house AI model (“Zia”) so it need not send your data to OpenAI. For data-locality purists it’s a striking offer. But Zoho is an Indian family-owned company, its European data centres are in Amsterdam and Dublin — a promised UK site hasn’t materialised — and “we own everything” means your alternatives if you fall out with them are precisely none. Self-sufficiency and sovereignty are related, but they are not the same word.

The most sovereign option is a free fork of an American product. SuiteCRM was born in Scotland in 2013, when a Stirling consultancy took the last open-source edition of SugarCRM — after SugarCRM walked away from open source — and kept building it. The code is fully open (anyone can read it, run it, or take it elsewhere), a UK company stewards it, and a UK buyer can self-host it on any infrastructure they choose: the strongest data-location position in this whole cohort, available from a free download. Companies House confirms it is UK-controlled: the active person with significant control is an individual based in Scotland, with no institutional or non-UK owner. It even comes with a real-world stress test. In early 2025 the original company behind it went into liquidation — and the product simply carried on, under a new Stirling company run by the project’s long-time technical lead. For every other vendor here, the failure of the company is the failure of the product; here, the open licence meant it wasn’t. That’s what open source buys in sovereignty terms: control over where the software runs, and over whether it survives the company that wrote it. The fine print is equally honest: self-hosting means you carry the patching, backups and security yourself (or pay a UK partner to), the hosted version uses Amazon for some regions, and the stewarding company is barely a year old. Control of your destiny comes with the maintenance schedule attached.

One more warning from the wider field: “open source” on the label doesn’t always mean it. We checked the open-source contenders, and they don’t all keep the promise. Twenty ^[34], a fast-rising American “open alternative to Salesforce,” keeps its cloud data in Frankfurt and runs an open-core model — the enterprise features sit under a proprietary licence. Poland’s YetiForce ^[35] markets itself as open but has moved its recent versions onto more restricted terms. EspoCRM ^[32] uses a mixed model. The survival guarantee only covers what the licence actually frees. If open source is part of your reason for choosing a product, read the licence, not the homepage — of the open contenders we examined, SuiteCRM, Odoo’s community edition and the charity-sector specialist CiviCRM ^[33] are the genuinely open ones, and SuiteCRM remains the only one stewarded from the UK.

What changed since our first look

This refresh re-checked the facts our earlier article rested on. Most held; a few were sharpened:

• Pipedrive — confirmed still US-owned, via Vista Equity Partners. No change.
• SuperOffice — confirmed Danish private-equity control (Axcel), and now via a fresh Axcel continuation fund as of June 2025. The Norwegian-origin label is history; the core database is still hosted in Norway by Visma, but documents and AI run on Microsoft Azure in the Netherlands and Ireland.
• SuiteCRM — confirmed UK and independent: a single Scotland-based individual is the controlling person, no institutional owner.
• Spotler CRM (formerly Really Simple Systems) — ultimate control sits with a Dutch parent in The Hague; data confirmed in Belgium on Google Cloud, with failover on Amazon in Stockholm and Paris.
• Capsule — confirmed US-hosted on Amazon, and we can now name its AI supplier: OpenAI.
• Workbooks — material ownership change: BGF (the UK Business Growth Fund) became a person with significant control in December 2025, and the founder ceased to be the majority controller. Still UK-controlled, but no longer founder-owned.
• SugarCRM — the company now trades as “SugarAI” (sugarcrm.com redirects to sugarai.com). Its cloud is still Amazon, but it names no AI model supplier on its public trust page.

What a UK buyer can actually do

You cannot buy your way to a perfectly British CRM today — the option doesn’t exist at any realistic price. What you can do is know exactly which compromises you’re making. Six questions will get you most of the way, and a vendor’s willingness to answer them crisply is itself a useful signal — a large part of the sector-specialist field markets itself on UK-ness but declines to say, in public, where the data actually sits:

1. Who ultimately owns you — and in which country? Not the brand: the owner, today. (Three of the vendors here changed hands or took new investment in the last year.)

2. Where exactly will my data be stored, and can I choose? Get the country and city, in writing.

3. Whose cloud does that location actually run on? “UK data centre” is the start of the answer, not the end — a UK building run by a US company is still within US legal reach.

4. When your AI features run, whose AI is doing the work, and where? Can I switch it off?

5. Which other companies touch my data — email delivery, phone calls, support tools — and where are they? Ask for the published list; serious vendors maintain one. The ones that keep it behind a login are telling you something.

6. If you’re acquired, what happens to my data and my contract? Several vendors here changed hands in the last six years. It’s not a hypothetical.

The honest conclusion is that sovereignty, for a UK business choosing a CRM, is not a yes/no purchase — it’s a dial. You can turn it a long way up (self-hosting, or a UK vendor that holds your data in the UK on its own documentation) at a real cost in convenience and features. You can leave it low with your eyes open (a US suite, with your encryption keys under your own control where that’s offered). What you can’t sensibly do anymore is assume the flag on the website tells you where your customer list actually lives. It almost never does. And there’s a fitting irony to where the search for the most sovereign CRM ends: at a free, Scottish-stewarded fork of an American product — kept alive not by any company, but by a licence no one can revoke.

Sources

All facts are taken from each vendor’s own published documentation (security, data-location and sub-processor pages) and from company registries, read directly during June 2026. One primary reference per vendor.

1. Salesforce — SEC filings: https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001108524&type=10-K ; Hyperforce/Einstein Trust Layer: https://help.salesforce.com/s/articleView?id=sf.generative_ai_trust_layer.htm
2. Microsoft (Dynamics 365) — Power Platform & Dynamics 365 datacenter regions: https://learn.microsoft.com/en-us/power-platform/admin/regions-overview
3. HubSpot — cloud infrastructure/data hosting FAQ: https://knowledge.hubspot.com/account-security/hubspot-cloud-infrastructure-and-data-hosting-frequently-asked-questions ; sub-processors: https://legal.hubspot.com/sub-processors-page
4. monday.com — sub-processors/subsidiaries: https://monday.com/l/privacy/sub-processors-subsidiaries-support/
5. Freshworks (Freshsales) — sub-processors: https://www.freshworks.com/privacy/sub-processor/
6. SugarCRM (“SugarAI”) — security & trust: https://sugarai.com/legal/security-trust
7. Pipedrive — sub-processors: https://www.pipedrive.com/en/subprocessors
8. Insightly — security/privacy: https://www.insightly.com/privacy-policy/
9. Zoho (Zoho CRM, Bigin) — data centres: https://www.zoho.com/know-your-datacenter.html ; security: https://www.zoho.com/security.html ; UK PSC: https://find-and-update.company-information.service.gov.uk/company/13424508/persons-with-significant-control
10. Odoo — privacy/hosting (OVHcloud + Google, France/Belgium): https://www.odoo.com/privacy
11. Efficy — security hub: https://www.efficy.com/group/security-hub/
12. Salesflare — data security (Google Cloud, St Ghislain, Belgium): https://howto.salesflare.com/en/articles/1013147-how-do-you-keep-my-account-secure-and-my-data-safe
13. SuperOffice — sub-processors (Visma Norway core; Microsoft Azure NL/IE for documents): https://www.superoffice.com/trust-center/agreements/sub-processors/ ; ownership (Axcel continuation fund, June 2025): https://axcel.com/company/superoffice/
14. OnePageCRM — security (AWS, transfer to US under SCCs): https://www.onepagecrm.com/security-2/
15. Attio — Companies House PSC: https://find-and-update.company-information.service.gov.uk/company/10719702/persons-with-significant-control ; privacy: https://attio.com/legal/privacy
16. Workbooks — Companies House PSC (BGF as PSC from Dec 2025): https://find-and-update.company-information.service.gov.uk/company/16783242/persons-with-significant-control ; sub-processors (Equinix UK + AWS Germany/UK): https://www.workbooks.com/legal/
17. Capsule (Zestia Ltd) — Companies House PSC: https://find-and-update.company-information.service.gov.uk/company/06418281/persons-with-significant-control (Zestia controlled by UK holding chain Bidco Koru Ltd → Topco Koru Ltd, whose active PSCs are founders Haines and Stockdill plus UK investor Newlands Capital 1 LLP — UK-controlled, not purely founder-owned) ; sub-processors (AWS USA; OpenAI): https://capsulecrm.com/dpa/subprocessors/
18. Spotler CRM (formerly Really Simple Systems) — Companies House PSC (Dutch parent): https://find-and-update.company-information.service.gov.uk/company/05978343/persons-with-significant-control ; data security (Google Cloud, Belgium): https://support.reallysimplesystems.com/cloud-crm-data-security/
19. SuiteCRM (SuiteCRM Ltd) — Companies House PSC: https://find-and-update.company-information.service.gov.uk/company/SC824064/persons-with-significant-control ; hosted/data region: https://suitecrm.com/suitecrmhosted/
20. Blackbaud — SEC filings: https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&company=blackbaud&type=10-K ; trust centre: https://trust.blackbaud.com/
21. Beacon (Beacon Apps Ltd) — Companies House PSC: https://find-and-update.company-information.service.gov.uk/company/11097096/persons-with-significant-control ; trust/data (UK, AWS+Google): https://www.beaconcrm.org/trust
22. Access Donorfy — security (Azure North Europe, Dublin): https://donorfy.com/security
23. donorflex (CMAC Computer Systems Ltd t/a Care Data Systems) — Companies House PSC: https://find-and-update.company-information.service.gov.uk/company/02518659/persons-with-significant-control ; privacy: https://www.donorflex.com/legal-rights-privacy/
24. Charitylog (Dizions Ltd / Noveva Software Group) — Companies House PSC: https://find-and-update.company-information.service.gov.uk/company/SC340502/persons-with-significant-control ; privacy (AWS UK): https://www.charitylog.co.uk/privacy/
25. Spektrix — company story/ownership (Norland Capital; Azure): https://www.spektrix.com/en-gb/spektrix-story
26. Tessitura — security (AWS; member-gated specifics): https://www.tessitura.com/support/security
27. iMIS (Advanced Solutions International) — platform (Microsoft Azure): https://www.imis.com/
28. Silverbear (ClearCourse Membership Services Ltd) — partners/privacy (Microsoft Dynamics + Azure): https://silverbear.com/Privacy-Policy
29. ToucanTech (ToucanTech Ltd) — Companies House PSC: https://find-and-update.company-information.service.gov.uk/company/08793687/persons-with-significant-control ; privacy (AWS EU): https://toucantech.com/privacy-policy
30. White Fuse (White Fuse Ltd) — Companies House PSC: https://find-and-update.company-information.service.gov.uk/company/06534733/persons-with-significant-control ; data-processing terms: https://whitefuse.com/data-processing-terms/
31. ChurchSuite (ChurchSuite Ltd) — Companies House PSC: https://find-and-update.company-information.service.gov.uk/company/08532235/persons-with-significant-control ; security (AWS UK): https://churchsuite.com/security/
32. EspoCRM — sub-processors (OVHcloud/Hetzner/20i; nearest DC): https://www.espocrm.com/subprocessors/ ; about: https://www.espocrm.com/about/
33. CiviCRM — about/governance (AGPL open source): https://civicrm.org/about
34. Twenty (Twenty.com PBC) — privacy (AWS Frankfurt EU; open-core): https://twenty.com/legal/privacy-policy
35. YetiForce (Stohid Technology S.A.) — company/registry: https://yetiforce.com/en/
36. Firefish Software — Companies House PSC (founder + Foresight VCTs): https://find-and-update.company-information.service.gov.uk/company/SC370891/persons-with-significant-control
37. Vincere (The Access Group) — privacy (redirects to Access Group): https://www.theaccessgroup.com/en-gb/privacy-notice/
38. itris (Itec Systems Ltd) — Companies House PSC (Talenttek UK Purchaser Ltd): https://find-and-update.company-information.service.gov.uk/company/03539993/persons-with-significant-control
39. Street.co.uk (Street Group Ltd) — Companies House PSC (founder-controlled): https://find-and-update.company-information.service.gov.uk/company/12168847/persons-with-significant-control
40. iamproperty (IAM-SOLD Ltd) — Companies House PSC: https://find-and-update.company-information.service.gov.uk/company/07051399/persons-with-significant-control
41. Twenty7tec (Twenty7tec Topco Ltd) — Companies House PSC (BGF): https://find-and-update.company-information.service.gov.uk/company/15806641/persons-with-significant-control
42. Axonaut (DIGITICA SAS) — legal notices (Scaleway/Online, France): https://axonaut.com/mentions-legales

*Data-residency sources (browser-render pass, June 2026): Firefish — all customer data in Microsoft Azure West Europe (Amsterdam) primary + North Europe (Dublin) secondary, “within the European Economic Area,” no UK option, AI features built to the EU AI Act with no named third-party supplier (firefishsoftware.com/trust, updated Oct 2025); itris X — “fully cloud-hosted, securely powered by Microsoft Azure,” “all client data is stored in UK-based Microsoft Azure data centres,” with its own “itris AI” features (itris.co.uk/recruitment-crm-ats-faqs); Vincere — “hosted in secure AWS data centres across London, Frankfurt, Virginia, Singapore, and Sy