A CRM for a bank differs from an ordinary one in three respects: a full audit trail (who changed what, and when), role-based access control (who sees what) and data residency, meaning customer data stays in Uzbekistan or right inside the bank’s own perimeter. For CIS banks these are not optional extras but conditions without which the system will not pass the internal security and compliance review. Zukko.AI covers these requirements with controls rather than certificates: AES-256 encryption at rest and TLS 1.3 in transit, RBAC, a full audit trail and regular pen-testing (Zukko.AI security). For banks there is on-prem or private cloud deployment, SSO/SAML login and a custom SLA on the Enterprise plan; such a project goes live within 30 days. On top of that perimeter works an AI employee (AI agent): it fills in the customer record from calls and conversations, and every change it makes is captured in the same audit trail.
Why a bank needs a different kind of CRM
Classic CRMs are optimised for sales velocity. A bank needs something else: every action must be traceable, access to customer data must be limited by role, and the data itself must sit under the regulator’s terms. Without that, the system will not pass an internal security review.
Three key requirements
| Requirement | What it means in practice |
|---|---|
| Audit trail | Every change to a record is captured: who made it, what changed, when — the basis for internal reviews |
| Access control (RBAC) | Access follows the role: an operator sees one thing, a manager another, an auditor a third |
| Residency and on-prem | Data of customers in Uzbekistan stays in the country; on-prem / private cloud is available for banks whose security policy does not allow data to leave their perimeter |
Since the ZRU-1125 amendment, the law “On Personal Data” (ZRU-547) requires in-country storage only for biometric and genetic data and telecom subscriber data; everything else may be processed abroad under the conditions of Article 27-1. Banks usually go further than the law and keep customer data inside their own perimeter as internal policy. What the law actually requires is covered in ZRU-547: personal data localisation.
Why “the data stays yours” is a principle
In the banking segment it matters that the data remains under the organisation’s control: no vendor lock-in, with export available. That reduces dependency risk and simplifies audit. More on storage modes on the Security and data page.
What the security team will ask: a vendor checklist
These eight questions come up in almost every security review. The vendor should back each answer with a document or a demonstration, not with words in a meeting.
| Question | What the vendor should show | How Zukko.AI handles it |
|---|---|---|
| Where is the data stored | the country and data centre in the contract | data of customers in Uzbekistan stays in the country; for banks, on-prem or private cloud |
| How is the data encrypted | algorithms at rest and in transit | AES-256 at rest, TLS 1.3 in transit |
| Who sees customer data | a role-based access model | RBAC: operator, manager and auditor see different scopes |
| How are changes tracked | a log of user actions | a full audit trail: who changed what, and when |
| How do staff sign in | integration with corporate accounts | SSO/SAML on the Enterprise plan |
| Has the system been tested for vulnerabilities | test results | regular pen-testing |
| Which certifications are there | copies of documents | we claim no certifications — we show the controls listed here |
| Is the customer’s voice used for identification | an answer in the contract | no: call recordings are used for transcription and quality control |
How this fits with an AI-CRM
The AI layer (filling the record in from calls and conversations) and the governance requirements do not contradict each other: AI speeds the work up, while the audit trail and RBAC keep it under control. Conversation analysis with data residency is described in the Call analysis module, and the single customer record on the AI-CRM page. How an AI-CRM works in general is covered in the guide, and how an AI employee differs from a scripted bot in what an AI employee is.
Frequently asked questions
Is every change to a record captured
Yes — the audit trail records who changed what, and when.
Can access to customer data be limited by role
Yes — role-based access control (RBAC) defines who sees what: an operator, a manager and an auditor each see a different scope of data.
Where is the bank’s data stored
Data belonging to customers in Uzbekistan is stored in the country; on-prem / private cloud deployment is available for CIS banks.
Does this satisfy ZRU-547
Zukko.AI helps you comply with ZRU-547 (residency, access control, audit); this is compliance support, not a legal guarantee.
Which certifications does the platform have
We claim no certifications. Instead we show the controls in place: AES-256 encryption at rest and TLS 1.3 in transit, role-based access, a full audit trail, regular pen-testing and deployment inside the bank’s perimeter.
How long does rollout at a bank take
A bank project with integrations, a security review and on-prem or private cloud deployment takes up to 30 days. It runs on the Enterprise plan with a custom SLA and SSO/SAML login.