CRM data security is the set of measures that keep a customer base from leaking, being lost or reaching outsiders: encryption, role-based access, an activity log and a known storage location. In Uzbekistan, Law No. ZRU-547 requires legal, organisational and technical protection measures, but names neither specific technologies nor mandatory certificates. Since amendment ZRU-1125 of 26 March 2026, Article 27-1 requires in-country storage for biometric data, genetic data and the data of telecom operators’ service users; other personal data may go abroad under that article’s conditions. So with a CRM vendor, check controls rather than promises: where the data sits, who sees it and with what rights, and whether every action is logged. In Zukko.AI, an AI agent platform for business, data of customers from Uzbekistan is stored in the country, access is limited by role and actions are written to an audit log. This supports compliance; it is not a legal guarantee, the legal duties stay with your company.
What CRM data security is and why it matters
Your CRM holds the most valuable material you have: customer contacts, deal history, conversations, call recordings. Where that data sits and who can see it is a matter of trust and of law. For banks, fintech and regulated companies it is often the deciding factor when choosing a system.
In practice security comes down to six controls. The table shows how each one works in Zukko.AI.
| Control | What it means |
|---|---|
| Storage location | Data belonging to customers in Uzbekistan is stored in the country |
| Deployment | SaaS, private cloud or on-prem — the customer chooses |
| Encryption | AES-256 at rest, TLS 1.3 in transit |
| Access control (RBAC) | Who sees what is defined by roles |
| Audit trail | Every user and AI action is recorded |
| Regular penetration testing | The defences are tested by an external contractor |
How this is built inside the platform is covered on the Security page; the customer-data perimeter is described under AI-CRM.
What the law requires of a business that stores customer data
The Law “On Personal Data” (Law No. ZRU-547, lex.uz) does not list technologies. Articles 27 and 31 oblige the owner and the operator to take legal, organisational and technical measures that ensure the integrity and safekeeping of the data, its confidentiality and the prevention of unlawful processing. How to get there — encryption, roles, logging — is left to the business.
| Common claim | What the law says |
|---|---|
| “All personal data must be stored in Uzbekistan” | Outdated. Since Law No. ZRU-1125 of 26 March 2026, Article 27-1 requires in-country storage for biometric data, genetic data and the data of telecom operators’ service users |
| “Localisation has been abolished” | No. For the three categories named, storage in Uzbekistan is mandatory |
| “Everything else can go abroad with no conditions” | No. One of the Article 27-1 conditions must be met: the foreign state is recognised as ensuring adequate protection, the operator has adopted standard contractual clauses or binding corporate rules, or the operator complies with international standards for managing and storing personal data |
| “The law requires an ISO 27001 certificate” | No. ZRU-547 names neither certificates nor specific technologies — it requires protection measures |
| “A CRM hosted in the country takes care of the law by itself” | No. The obligations stay with the owner and the operator of the data; the platform helps you meet them |
Where to store CRM data: in Uzbekistan or abroad
Residency means the data is physically stored in a specific country. Since the ZRU-1125 amendment (lex.uz) that is an obligation for three categories of data and, for the rest, a business decision made within the Article 27-1 conditions. An ordinary customer base — name, phone number, order history — does not usually fall into the three categories, but the answer depends on your industry.
Zukko.AI stores the data of customers in Uzbekistan inside the country. That is a product advantage, not a legal requirement for everyone: the data is close at hand, the jurisdiction is clear, and banks and the public sector often make in-country storage and on-prem a condition in their own requirements.
Call recordings deserve separate attention: if you store and analyse calls, the voice is stored along with the text. Whether a voice recording counts as biometric data in your scenario is a question for your lawyer. How that perimeter works is set out under Call analysis, and the telephony side under Telephony (VoIP). A detailed comparison of jurisdictions is in “Data in Uzbekistan vs Russia/EU”.
What to check with a CRM provider before you sign
- Storage location. Which country holds the database, files and backups, and whether the contract says so.
- Encryption. Whether data is protected both at rest and in transit.
- Access. Whether roles can limit who sees contacts, deals and call recordings.
- Activity log. Whether you can see who opened or changed data, and when.
- Deployment. Whether private cloud or on-prem is available if data must not leave your perimeter.
- Testing. Whether external penetration tests are run and the report is available under NDA.
A small business sets up and launches Zukko.AI on its own, from 2 hours; an enterprise rollout with private cloud or on-prem takes up to 30 days.
An honest word on certifications
On certifications we are blunt: we claim none. Instead we show the controls that are already in force: encryption, role-based access, a full audit trail, regular penetration testing and deployment inside the customer’s own perimeter. We apply GDPR practices and help you comply with ZRU-547 — that is compliance support, not a legal guarantee. What the law actually obliges a business to do is covered in the article on ZRU-547 and personal data localisation.
Frequently asked questions
What is CRM data security
It is the set of measures that protect a customer base from leaks, loss and unauthorised access. There are usually six: a known storage location, encryption at rest and in transit, role-based access, an activity log, a choice of deployment model and regular external testing. Uzbek law requires legal, organisational and technical measures from a business without naming specific technologies.
Does CRM data have to be stored in Uzbekistan
Not always. Since the ZRU-1125 amendment of 26 March 2026, Article 27-1 of Law No. ZRU-547 requires in-country storage for biometric and genetic data and for the data of telecom operators’ service users. Other personal data may be stored abroad if one of the conditions in that article is met. Confirm with a lawyer which category your data falls into.
Does the law require an ISO 27001 certificate
No. ZRU-547 names neither ISO 27001 nor any other certificate: Articles 27 and 31 require legal, organisational and technical protection measures. Compliance with international standards appears in Article 27-1 only as one of the conditions for storing data abroad. Certificate requirements may be written into a contract with your own customer, so check those separately.
Where does Zukko.AI store data and how is it encrypted
Data belonging to customers in Uzbekistan is stored in the country. It is encrypted with AES-256 at rest and TLS 1.3 in transit. Access is separated by roles, and every user and AI action goes into the audit trail. Deployment is SaaS, private cloud or on-prem; for CIS banks and regulated companies that keeps data inside their own perimeter.
Is Zukko.AI compliant with ZRU-547
Zukko.AI helps you comply with ZRU-547: data belonging to customers in Uzbekistan is stored in the country, access is limited by roles and actions are recorded in a log. This is compliance support, not a legal guarantee. The legal obligations stay with the owner and operator of the data — your company — and a lawyer assesses your specific scenario.
Which certifications does Zukko.AI hold
We claim none. Instead of certificates we show the controls in force: AES-256 and TLS 1.3 encryption, role-based access, a full audit trail, regular penetration testing by an external contractor and deployment inside the customer’s perimeter. Enterprise customers can request the penetration test report and a completed security questionnaire under NDA. We also apply GDPR practices.
Does a small business need on-prem
Usually not. On-prem and private cloud are chosen by CIS banks and regulated companies that need data to stay inside their own perimeter; that kind of rollout takes up to 30 days. For a small business the cloud version with encryption, roles and an activity log is enough — you set it up yourself, and launch starts from 2 hours.