CRM data is stored on servers the vendor chooses: in a cloud system, in the vendor’s data centre; on-prem, on the company’s own servers. Uzbekistan law requires biometric data, genetic data and telecom service user data to be kept in the country; other personal data may be stored abroad under the conditions of Article 27-1 of Law No. ZRU-547. This wording applies since the ZRU-1125 amendment of 26 March 2026. An ordinary customer base — name, phone, order history — usually falls outside the three categories, while call recordings are a question for a lawyer. Before migrating, get the vendor to confirm in writing the country and data centre, where backups sit, who can access the data and how to export it if you leave. Zukko.AI, an AI agent platform for business, keeps the data of Uzbek customers in Uzbekistan, encrypts it with AES-256 at rest and TLS 1.3 in transit, and offers CIS banks private cloud or on-prem.
Where CRM data is stored
Customer contacts, conversations, deal history and call recordings live wherever the servers are. Where exactly depends on the deployment model. With a cloud CRM the vendor picks the country of storage, and it is written into the contract or the data-processing policy. If it is not there, that is your first question to the vendor.
| Deployment model | Where the data physically sits | Who chooses the country of storage |
|---|---|---|
| Cloud (SaaS) | In the vendor’s data centre or with its cloud provider | The vendor; the country is stated in the contract |
| Private cloud | In a dedicated environment, separate from other customers | Agreed with the customer |
| On-prem | On the company’s own servers | The company itself |
| Zukko.AI | Data of customers in Uzbekistan — in Uzbekistan | SaaS, private cloud or on-prem — the customer’s choice |
Foreign CRM systems most often place data in data centres outside Uzbekistan. That is not a breach in itself: what matters is which data you put there. How protection works as a whole is covered in the CRM security guide.
What data residency is
Data residency is the principle that data is physically stored on servers in a specific country. For a company in Uzbekistan it means customer contacts, conversations and deal history sit on servers in the country and fall under local law. Residency answers “where”, not “how well protected”: encryption, access rights and the activity log are checked separately.
What Uzbekistan law requires for storing personal data
The rule “all personal data of citizens is stored only in Uzbekistan” no longer applies in its earlier form. Law No. ZRU-1125 of 26 March 2026 restated Article 27-1 of the Law “On Personal Data” (Law No. ZRU-547) (lex.uz). Mandatory localisation remains, but for three categories of data.
| Category of data | What Article 27-1 of Law No. ZRU-547 provides |
|---|---|
| Biometric data | Must be stored in the territory of Uzbekistan |
| Genetic data | Must be stored in the territory of Uzbekistan |
| Data of users of telecom operators’ services | Must be stored in the territory of Uzbekistan |
| Other personal data | May be stored and processed abroad if one of the conditions is met: the state is recognised as providing adequate protection; contractual clauses or corporate rules approved by the authorised body are adopted; international standards from the official list are observed |
An ordinary customer base — name, phone number, order history — usually falls outside the three categories, but the conclusion depends on your industry. Call recordings are a separate matter: whether a voice in a recording counts as biometric data depends on how the recording is processed, and that is a question of interpretation for a lawyer. The law does not require a CRM operator to hold a certification under international standards. A detailed breakdown is in the article on personal data localisation under ZRU-547.
What a business risks when data is stored abroad
- The legal requirement. If data from the three categories ends up in the CRM, storing it abroad conflicts with Article 27-1. For other data, one of that article’s conditions has to be met.
- A foreign jurisdiction. The data is also subject to the law of the country where the server stands.
- Security reviews by large customers. CIS banks and regulated companies ask where the data sits during a security review and may require in-country storage or on-prem, whatever the law permits.
- Access control. The less you know about the hosting site, the harder it is to show who saw a customer’s data and when.
What to ask a CRM vendor about data storage
- Which country hosts the servers with live data and with backups.
- Whether the country of storage is written into the contract or the data-processing policy.
- Which of the vendor’s staff can access the data, and whether an activity log is kept.
- How the data is encrypted at rest and in transit.
- Whether private cloud or on-prem is available if your customer or regulator requires it.
Get the answers in writing and before you migrate the customer base: changing the hosting site after migration is considerably harder.
Where Zukko.AI stores data
Zukko.AI stores the data of customers in Uzbekistan in Uzbekistan. Deployment is the customer’s choice: SaaS, private cloud or on-prem. Data is encrypted with AES-256 at rest and TLS 1.3 in transit, access is restricted by role (RBAC), and every user and AI action is written to the audit trail. In-country storage is a property of the product, not a legal duty for every kind of data: it gives a clear jurisdiction and meets the requirements of CIS banks and regulated companies. This is help with meeting the requirements, not a legal guarantee. Details are on the Security page; the data perimeter itself is in AI-CRM.
What the business gets
- A clear jurisdiction — the data of customers in Uzbekistan stays in the country.
- A short answer at review time — “where is the data” gets a concrete answer, not a pointer to a foreign provider.
- Visible access — roles and the audit trail show who worked with the data.
- A choice of environment — SaaS for a small business with go-live from 2 hours, private cloud or on-prem for enterprise with a rollout of up to 30 days.
If the business records and analyses conversations, voice joins the perimeter — how that works is described under Call analytics. A comparison of hosting locations is in “Data in Uzbekistan or in Russia/EU”.
Frequently asked questions
Where is CRM data physically stored
Wherever the vendor’s servers are. With a cloud CRM that is the vendor’s data centre or its cloud provider, and the country of storage is written into the contract or the data-processing policy. In a private cloud the data sits in a dedicated environment; on-prem, on the company’s own servers. Zukko.AI stores the data of customers in Uzbekistan in Uzbekistan.
Does a company have to store customer data in Uzbekistan
It depends on the category of data. Article 27-1 of Law No. ZRU-547, as restated by Law No. ZRU-1125 of 26 March 2026, requires biometric data, genetic data and the data of telecom operators’ service users to be stored in Uzbekistan. Other personal data may be stored abroad under one of that article’s conditions. A lawyer confirms your category.
What is data residency in plain words
Data residency is the principle that data is physically stored on servers in a specific country. For a company in Uzbekistan it means customer contacts, conversations and call recordings sit on servers in the country and fall under local law. Residency answers “where”, not “how well protected” — encryption and access rights are checked separately.
Can CRM data be stored abroad
For personal data that is not biometric, genetic or telecom service user data — yes, under one of the conditions of Article 27-1 of Law No. ZRU-547: the state is recognised as providing adequate protection, approved contractual clauses or corporate rules are adopted, or international standards from the official list are observed. Check with a lawyer whether your vendor meets one.
Are call recordings biometric data
There is no single answer: it is a question of interpretation. A voice can be used to identify a person, and the law requires biometric data to be stored in Uzbekistan. Whether an ordinary recording of a customer call counts depends on how it is processed. A lawyer gives the legal assessment; keeping recordings in-country makes the question less pressing.
What should I ask a CRM vendor about data storage
Five things: which country hosts the servers and backups; whether the country of storage is in the contract; which vendor staff can access the data and whether an activity log is kept; how data is encrypted at rest and in transit; and whether private cloud or on-prem is available. Get the answers in writing before you migrate.
Where does Zukko.AI store data, and is on-prem available
Zukko.AI stores the data of customers in Uzbekistan in Uzbekistan. Deployment is the customer’s choice: SaaS, private cloud or on-prem. Data is encrypted with AES-256 at rest and TLS 1.3 in transit, access is restricted by role, and user and AI actions are written to the audit trail. This is help with compliance, not a legal guarantee.