Sign in Start free

Subprocessors

Subprocessors

ArabyCRM uses a short list of trusted providers to run the service. This page is updated when the supplier mix changes.

Last updated: June 10, 2026

Provider	Purpose	Processing region	Data categories
Microsoft Azure (AKS + App)	Application hosting, container orchestration, ingress, secrets, monitoring.	West Europe	All workspace traffic and Customer Data in flight; logs and metrics in operational telemetry.
Microsoft Azure (Managed PostgreSQL)	Primary database for accounts, workspaces, CRM records, and audit history.	West Europe	Account data, workspace settings, Customer Data, audit logs, billing metadata.
Cloudflare R2	File Vault object storage for invoices, attachments, signed documents, and branding assets.	EU buckets where available; global edge	File uploads, generated PDFs, branding assets.
PayPal	Subscription plan checkout, recurring billing, webhook delivery, refunds.	Global (PayPal-owned infrastructure)	Billing email, plan and subscription state, transaction amount, masked payment-instrument identifiers (no full card numbers).
Microsoft 365 SMTP	Outbound transactional email (account, billing, security, reminders, invoices, document signing).	Microsoft EU data centers	Recipient address, subject, message body, attachments you choose to send.
Google (OAuth)	Optional social sign-in identity verification.	Global (Google-owned infrastructure)	Email address and basic profile returned by Google when you choose to sign in with Google.
GitHub (OAuth)	Optional social sign-in identity verification.	Global (GitHub-owned infrastructure)	Email address and basic profile returned by GitHub when you choose to sign in with GitHub.

Microsoft Azure (AKS + App)

Purpose: Application hosting, container orchestration, ingress, secrets, monitoring.
Processing region: West Europe
Data categories: All workspace traffic and Customer Data in flight; logs and metrics in operational telemetry.

Microsoft Azure (Managed PostgreSQL)

Purpose: Primary database for accounts, workspaces, CRM records, and audit history.
Processing region: West Europe
Data categories: Account data, workspace settings, Customer Data, audit logs, billing metadata.

Cloudflare R2

Purpose: File Vault object storage for invoices, attachments, signed documents, and branding assets.
Processing region: EU buckets where available; global edge
Data categories: File uploads, generated PDFs, branding assets.

PayPal

Purpose: Subscription plan checkout, recurring billing, webhook delivery, refunds.
Processing region: Global (PayPal-owned infrastructure)
Data categories: Billing email, plan and subscription state, transaction amount, masked payment-instrument identifiers (no full card numbers).

Microsoft 365 SMTP

Purpose: Outbound transactional email (account, billing, security, reminders, invoices, document signing).
Processing region: Microsoft EU data centers
Data categories: Recipient address, subject, message body, attachments you choose to send.

Google (OAuth)

Purpose: Optional social sign-in identity verification.
Processing region: Global (Google-owned infrastructure)
Data categories: Email address and basic profile returned by Google when you choose to sign in with Google.

GitHub (OAuth)

Purpose: Optional social sign-in identity verification.
Processing region: Global (GitHub-owned infrastructure)
Data categories: Email address and basic profile returned by GitHub when you choose to sign in with GitHub.

Notes

We do not use third-party advertising or analytics subprocessors. No marketing pixels are loaded on this site.
Tenants on paid plans can connect their own SMTP sender. In that case the tenant's chosen provider is the subprocessor for those messages, not Microsoft 365.
Standard Contractual Clauses (SCCs) and equivalent UK transfer mechanisms are in place with each provider where required by the GDPR or UK GDPR.