Security and GDPR
Kumulator protects access with an encrypted session, sign-in limits and optional two-factor authentication, limits what each role can see, encrypts integration keys and records GDPR consent from forms. The AI features process data in the EU and never receive your customers’ personal details.
What should you check before giving distributors access to your CRM?
Who sees what
Partners must see only their own leads, never your customer base.
How access is protected
Passwords, second factor and limits on sign-in attempts.
Where data goes
Which providers process it, and what reaches an AI model.
How does Kumulator protect your data?
- 01
Access
An encrypted session cookie, at most 10 sign-in attempts per email and 30 per IP every 15 minutes, two-factor authentication with an authenticator app and backup codes, and reset links valid for one hour.
- 02
Roles and permissions
Owner, admin, manager, sales rep, viewer, dealer and regional roles, with data access set to all, team or own, and permissions per module.
- 03
Encryption and integrity
Integration tokens and keys encrypted with AES-256-GCM, with key rotation; messages from Meta, HubSpot and Shopify verified by signature.
- 04
GDPR and AI
Consent recorded in forms with double opt-in; names, emails and phone numbers removed before text reaches the AI, which runs in the EU; history of field changes, stages and agent decisions.
One deal, seen by each role
Switch the role to see what each person gets: the sales team sees everything, the regional manager reads, the distributor sees only their own lead.
Sub-processors
| Provider | Purpose |
|---|---|
| Vercel | Application hosting |
| Neon / PostgreSQL | Database |
| Resend | System transactional emails |
| Google / Microsoft | Gmail and Outlook connections, with your consent |
The full list of sub-processors is in the privacy policy.
Frequently asked questions
Can distributors see my other customers?
No. A dealer sees only the copies assigned to them and the deals they own; contacts are not copied to dealers.
Is two-factor authentication available?
Yes, with an authenticator app (TOTP) and backup codes, enabled from each user’s profile.
Which AI provider do you use?
The AI agents use Mistral, with processing in the EU, and receive only the minimum needed, without personal details.