European CRM: who owns the vendor and where your data lives
You want a CRM that keeps customer data in Europe. Many lists call a tool “European” because of an office in Paris or a server in Frankfurt. But the company may be registered in Delaware. And the server may belong to a US cloud. So we looked at each vendor's own legal notice, privacy policy, subprocessor list and pricing page. Where a vendor says nothing, the table says so.
We make The-Y CRM, so we are not neutral. We list ourselves with the same columns as everyone else. Company and servers are in Vienna, Austria (netcup, Vienna data centre). The-Y CRM is not open source; it is proprietary and can be self-hosted. Free is €0 for up to 3 users. Cloud Pro is €20/month per company, all users and brands included (Alpha & Beta price).
EU companies: seat, servers, owner, price
All values come from the vendors' own pages, accessed on 6 Nov 2026. Links are in the sources at the end.
| CRM | Company & seat | Customer data hosted | Parent company | Open source | WhatsApp / phone | Entry price |
|---|---|---|---|---|---|---|
| The-Y CRM | The-Y e.U., Vienna, Austria | Vienna data centre, Austria (netcup); or on your own server | none (e.U., a sole proprietorship) | no (proprietary) | both built in (WhatsApp Business Platform, own phone system) | Free up to 3 users; Cloud Pro €20/month per company, all users and brands included |
| CentralStationCRM | 42he GmbH, Cologne, Germany | data centres in Germany; the DPA names Hetzner, STACKIT and Core-Backbone (some only for backups) | not stated | no | WhatsApp not mentioned; phone via integrations (e.g. sipgate CLINQ, Placetel) | free “Starter” (3 users, 200 contacts); “Team” €25/month for 3 users, excl. VAT |
| Teamleader Focus | Teamleader NV, Ghent, Belgium | AWS data centres in Ireland | Visma Group (parent: Visma AS) | no | both via marketplace apps (e.g. TimelinesAI for WhatsApp; VoIP apps) | no free plan (14-day trial); per user, billed quarterly or yearly, excl. VAT |
| Efficy | efficy SA, Kraainem, Belgium | France, per Efficy's sovereignty page (provider not named) | not stated | no | WhatsApp listed as a service channel; phone via connectors | no free plan shown; “Sales” €69 per user/month |
| Brevo | Brevo SAS, Paris, France (German entity: Brevo GmbH, Berlin) | OVH (France, Germany) and Google Cloud (Belgium) | Brevo GmbH is a subsidiary of Brevo SAS | no | WhatsApp campaigns in Professional and Enterprise; VoIP calls in a higher service plan | free plan (300 emails/day); “Starter” €7/month, excl. VAT |
| Pipedrive | Pipedrive OÜ, Tallinn, Estonia (contract partner for EU customers) | AWS, Frankfurt or Dublin for EU customers | not stated | no | WhatsApp via own integration; no built-in calling, marketplace apps | no free plan (14-day trial); “Lite” €14 per seat/month, billed yearly |
“No” under open source means: the vendor names no open-source licence for its product. “Not stated” means: we found nothing on the vendor's legal notice, privacy policy, DPA, subprocessor list or pricing page. Prices as shown on 6 Nov 2026, with the VAT note the vendor gives; The-Y prices include VAT. Vendors change prices and hosting – please check their pages before you decide.
Open source CRMs
If you want the source code, these three are often named. Note where the companies behind them are registered.
| CRM | Company & seat | Hosting | Parent company | Open source | WhatsApp / phone | Entry price |
|---|---|---|---|---|---|---|
| Twenty | Twenty.com PBC, Delaware, USA | self-host, or their cloud in Frankfurt (EU) | not stated | yes, mostly AGPL-3.0 | neither built in | self-hosting free; cloud “Pro” $9 per user/month, billed yearly |
| SuiteCRM | SuiteCRM Ltd, Stirling, Scotland (UK) | self-host, or their hosting on AWS or their own cloud in Scotland | not stated | yes, AGPL-3.0 | both via third-party add-ons | self-hosting free; hosting as a flat monthly fee (two SuiteCRM pages give different starting prices) |
| EspoCRM | EspoCRM, Inc., Austin (Texas), USA | self-host, or their cloud in the US or Germany (your choice) | not stated | yes, AGPL-3.0 | WhatsApp not mentioned; phone via paid official VoIP extension | self-hosting free; cloud “Basic” €12.90 per user/month, min. 3 users |
Often listed as “hidden gems” – but not EU companies
| CRM | Company & seat | Customer data hosted | Parent company | Open source | WhatsApp / phone | Entry price |
|---|---|---|---|---|---|---|
| Attio | Attio Limited, London, UK | Google Cloud; region not stated | not stated | no | both via apps (e.g. TimelinesAI; Aircall, RingCentral) | free plan up to 3 seats; “Plus” €31 per user/month, billed yearly |
| folk | Folk Inc., Wilmington (Delaware), USA | AWS, Ireland | not stated | no | WhatsApp sync via the folkX browser extension; call recording in the mobile app | no free plan (2-week trial); “Standard” €22 per member/month, billed yearly |
What “GDPR-compliant CRM” really means
No CRM is GDPR-compliant on its own. It depends on how you use it. But a vendor can make it easy or hard. Check these eight points:
- Data processing agreement (DPA). Under Art. 28 GDPR you need one with the vendor. Can you read it before you sign up?
- Subprocessors by name. Who else touches the data – hosting, email delivery, backups? In which country?
- Server location. Where is the customer data stored? Where are the backups?
- Company seat and owner. A server in the EU does not settle everything. According to the US Department of Justice, providers subject to US jurisdiction must hand over data on valid US legal process, no matter where they store it (CLOUD Act).
- Transfers outside the EU. If data goes to the US, there needs to be a legal basis. The EU–US Data Privacy Framework only covers US companies that take part in it. Otherwise standard contractual clauses are a common route.
- Delete for good. Can you delete one person with all messages, files and call recordings? How long does the data stay in backups?
- Export. Can you get all your data out, in a format you can use elsewhere?
- Consent per channel. Can you record who agreed to email, SMS or WhatsApp – with date and source?
Services you connect yourself (your email provider, WhatsApp/Meta, SMS, AI) process data under their own terms. Check them too. This is background, not legal advice.
The same eight points for The-Y CRM
- DPA: our DPA under Art. 28 GDPR is public. A signed copy is available on request.
- Subprocessors (DPA, Annex 2): netcup GmbH (Karlsruhe) runs the production server in the Vienna data centre. Backups go to our own server at a separate location in Austria.
- System emails: sign-in links, invitations and similar emails from the CRM go through SMTP2GO (Sand Dune Mail Ltd, New Zealand), only through its EU data centre in Amsterdam. Emails to your customers only go through your own mailbox. Details in our privacy policy.
- Our own company email (e.g. office@the-y.at) is on a mail server with RackNerd in the USA. The CRM and your customers' data do not pass through it. We say this openly because you will see it in our privacy policy.
- Delete: you delete a contact for good, with conversations, attachments and recordings. Data can stay in backups for up to 30 days. How deletion works.
- Export: admins export contacts, companies, deals and conversations as CSV, or the whole account as a snapshot.
- Consent per channel: email, SMS, WhatsApp and calls, each with date and source. WhatsApp and SMS campaigns only go to contacts with consent.
- No certificate: no ISO 27001, no SOC 2. What we do is on our security page.
Another tool fits better if …
- you need open source – then look at Twenty, SuiteCRM or EspoCRM; The-Y CRM is proprietary,
- you need a certified vendor (e.g. ISO 27001) – we have no certificate,
- you need software with years in production – The-Y CRM is in Alpha,
- you mainly send email newsletters – a specialist like Brevo has more for that,
- you only need a sales pipeline, without phone or WhatsApp – then a sales CRM like CentralStationCRM or Pipedrive may be enough.
The-Y CRM fits if …
- you want company and servers in one EU country (Austria),
- customers reach you by email, WhatsApp and phone – all in one inbox, with a built-in phone system,
- you want one price per company instead of per seat,
- you may want to move to your own server later – same software, your data comes along.
Frequently asked questions
Is The-Y CRM open source?
No. The-Y CRM is proprietary software from The-Y e.U. in Vienna. You can self-host it with a licence key, but the source code is not open. If you need open source, look at Twenty, SuiteCRM or EspoCRM.
Where does The-Y CRM store my data?
If we host it (Free or Cloud Pro): on a server in Austria, in a data centre in Vienna run by netcup. Backups go to a second, separate location in Austria. If you self-host, your data stays on your own server.
Is a CRM with servers in the EU automatically GDPR-compliant?
No. The server location is only one point. You also need a data processing agreement, a list of subprocessors, a way to delete and export data, and a legal basis for any transfer outside the EU. Who owns the vendor matters too. This is background, not legal advice.
Which European CRMs have a free plan?
In our table: CentralStationCRM (Starter: 3 users, 200 contacts), Brevo (free plan; its sales CRM is limited to 50 open deals and one pipeline) and The-Y CRM Free (up to 3 users). Twenty, SuiteCRM and EspoCRM are free to self-host; you pay for the server.
What does The-Y CRM cost?
Free costs €0 for up to 3 users. Cloud Pro costs €20/month per company, all users and brands included, hosted in Vienna. Self-hosting costs from €10 a month or €240 one-time. These are Alpha and Beta prices; Cloud Pro will cost €40 a month from the Live release.
Check it yourself – with your own data or with ours.
Create a free account and connect your mailbox – or click through the demo with sample data first. The demo is deleted after 24 hours.
Security & operations: servers, backups, updates · What The-Y CRM really costs · Self-hosted helpdesk · Helpdesk software · Shared inbox · HubSpot alternative · All comparisons
Sources (accessed 6 Nov 2026)
- The-Y CRM: security page (servers, backups, no certificate), DPA incl. Annex 2, privacy policy (SMTP2GO, RackNerd), costs, docs: consent
- CentralStationCRM: legal notice, security, DPA (Annex 3), extensions, pricing
- Teamleader Focus: terms, privacy statement, DPA, marketplace: chat, marketplace: VoIP, pricing
- Efficy: terms, digital sovereignty, customer service, integrations, pricing
- Brevo: legal notice, terms incl. subprocessors (Annex 2), WhatsApp campaigns, all features, pricing
- Pipedrive: terms (§14.1), subprocessors, WhatsApp, calling, pricing
- Twenty: terms, privacy, licence, pricing
- SuiteCRM: SuiteCRM Ltd, hosting, pricing, licence, add-on store
- EspoCRM: cloud agreement, pricing, download & licence, VoIP extension
- Attio: services agreement, DPA, communication apps, pricing
- folk: privacy policy, WhatsApp, call recording, pricing
- Law and transfers: US DOJ, CLOUD Act white paper (10 Apr 2019), European Commission: EU–US data transfers
All product names are trademarks of their owners. This comparison is independent and made to the best of our knowledge; please report errors to office@the-y.at and we'll correct them right away.