Zukko.AI security means enterprise data protection with residency in Uzbekistan: data belonging to customers in Uzbekistan is stored in the country, and on-prem / private cloud is available for banks. AES-256 encryption at rest and TLS 1.3 in transit, role-based access control (RBAC) and a full audit trail, with regular penetration testing. Zukko.AI helps you comply with ZRU-547 “On Personal Data”. We claim no certifications — we state the controls that are actually in place.
Why “where is the data stored” is a serious question
Your CRM holds the most valuable material you have: customer contacts, deal history, conversations, call recordings. Where that data physically sits is not an abstraction but a matter of trust and of law. For banks, fintech and regulated companies it is often the deciding factor when choosing a system.
Classic global CRMs — Western and Russian alike — keep data in EU, US or Russian data centres and do not offer residency in Uzbekistan or on-prem for a bank. That is a structural limitation of the platform, not a setting in the admin panel.
What data protection is made of
| Control | What it means |
|---|---|
| Residency | Data belonging to customers in Uzbekistan is stored in the country |
| On-prem / private cloud | For CIS banks and regulated companies |
| Encryption | AES-256 at rest, TLS 1.3 in transit |
| Access control (RBAC) | Who sees what is defined by roles |
| Audit trail | Every action on the data is recorded |
| Regular penetration testing | The defences are tested for real |
How this is built inside the platform is covered on the Security page; the customer-data perimeter is described under AI-CRM.
Data residency versus data abroad
Residency means the data is physically stored in a specific country. For Uzbekistan that matters twice over: the ZRU-547 law “On Personal Data” (as amended by ZRU-1125 of 26 March 2026) requires localisation for biometric data, genetic data and telecom subscriber data. Because voice biometrics may be present in call recordings, “the server is in Uzbekistan” remains a strong argument. Banks and regulated companies require in-country and on-prem regardless of how the law is relaxed.
Call recordings deserve separate attention: if you store and analyse calls, the voice is stored along with the text. How that perimeter works is set out under Call analysis, and the telephony side under Telephony (VoIP). A detailed comparison of jurisdictions is in “Data in Uzbekistan vs Russia/EU”.
An honest word on certifications
On certifications we are blunt: we claim none. Instead we show the controls that are already in force: encryption, role-based access, a full audit trail, regular penetration testing and deployment inside the customer’s own perimeter. We apply GDPR practices and help you comply with ZRU-547 — transparency beats overstatement. What the law actually obliges a business to do is covered in the article on ZRU-547 and personal data localisation.
Frequently asked questions
Where is my data physically stored?
Data belonging to customers in Uzbekistan is stored in the country; on-prem / private cloud is available for banks and regulated companies.
How is the data encrypted?
AES-256 at rest and TLS 1.3 in transit.
Is Zukko.AI compliant with ZRU-547?
Zukko.AI helps you comply with ZRU-547 (residency, access control, audit trail); this is compliance support, not a legal guarantee.
Is there an on-prem option for banks?
Yes — on-prem / private cloud for CIS banks and regulated companies, with the data held in country.
Which certifications do you hold?
We claim no certifications at all: we state the controls in force — encryption, role-based access, an audit trail, penetration testing and data inside the customer’s perimeter. Plus GDPR practices and support for ZRU-547 compliance.