Security & Compliance

What we do well

• EU-hosted CRMThe production CRM database is hosted in an IONOS data centre in Germany (EU). Optional tools you connect yourself (for example Gmail) keep their own region rules.
• Organisation isolationEach agency’s artists, contracts, fees, and mail stay inside that organisation. Other tenants cannot see your roster.
• Access by assignmentManagers see the artists they are assigned to. We do not treat “everyone in the office” as a reason to open the whole roster.
• Email login verificationOrganisations can require a one-time code by email at login, so a stolen password is not enough to walk into the CRM.
• Sign in with an account you already haveSign in with Google, Microsoft or Apple. That is not enterprise SAML or OIDC SSO.
• Encrypted backupsDatabase backups are encrypted with AES-256-CBC so copies of the CRM are not sitting around in plain text.
• We do not sell dataArtist and agency data is used to run the product you signed up for. We do not sell personal data to advertisers.
• AI, one task at a timeAI features send only the minimum text needed for one task to our AI provider, Novita AI, which is in the USA. Nothing is sent in bulk. We do not claim EU-only AI processing.

What we do not claim

We do not currently publish SOC 2, ISO 27001, HIPAA, or eIDAS qualified-signature certifications. This page describes controls that are actually in the product and in how we host the CRM — not a badge list.

• HostingWe do not say “hosted in Poland.” Production CRM hosting is IONOS in Germany. Poland is governing law in our terms only.
• AIWe do not say “EU-only AI.” Novita AI is listed as USA in our data processing agreement.
• E-signatureBuilt-in signing is a secure link with an optional one-time code and a certificate. It is not a qualified or court-grade electronic signature.
• Single sign-onSign-in is password, email-code 2FA, or Google / Microsoft / Apple. We do not offer enterprise SAML or OIDC SSO.

If your agency needs a data processing agreement, a security questionnaire, or a written list of subprocessors, write to support@artisthub24.com and we will work through it with you.