Twenty CRM GDPR Compliance Guide: Setup & Deployment

Twenty CRM, the open-source customer relationship management platform with 57.5K GitHub stars, is GDPR compliant by design. Whether you self-host it or use Twenty's managed cloud offering, you can implement GDPR compliance, but the operational burden differs significantly. This guide covers what you must do to stay compliant, the built-in features Twenty provides, and the real cost of each deployment option.

GDPR (General Data Protection Regulation) is a European privacy law that applies to any company handling data of EU residents, regardless of where you operate. For a CRM, it means you must:

Collect and store customer data lawfully, with explicit consent.
Encrypt data at rest and in transit.
Process data only for stated purposes.
Grant users the right to access, correct, and delete their data.
Report data breaches to authorities within 48 hours.
Maintain audit logs proving compliance.

The law does not mandate specific tools or vendors. It mandates processes and technical controls. A CRM vendor can help you meet these requirements, but the responsibility for compliance rests with you (the data controller) and, if you hire the vendor to process data, a Data Processing Agreement (DPA) must exist.

For self-hosted deployments, you are the data processor and controller. You own the infrastructure, security, and deletion workflows. This flexibility means you can meet GDPR, but you must do the work yourself. For managed offerings like Twenty Cloud, Twenty acts as your data processor, and you rely on their DPA and security practices to meet your GDPR obligations.

Open-source software has structural GDPR advantages. Because Twenty's code is open and auditable, you can:

Review encryption implementations yourself.
Verify data handling in the source code.
Control where data is stored (self-hosted option).
Avoid vendor lock-in and data portability issues.

Twenty was founded in 2023 with privacy as a design principle, not an add-on. The platform includes encryption, audit logging, and data deletion capabilities built in. For Twenty Cloud users, the company holds SOC 2 certification (an independent audit of security controls) and is GDPR certified, meaning their managed offering meets the standard.

When you host Twenty yourself, you gain even more control: you choose the hosting location, backup retention, and encryption keys. For regulated industries (finance, healthcare, legal), this is often a requirement. The trade-off is operational burden: you are responsible for security, backups, and compliance documentation.

Twenty includes specific features that support GDPR compliance across data, access, and deletion:

Data Encryption

Twenty encrypts customer data in transit (TLS/SSL) and at rest (AES-256). For self-hosted deployments, you control encryption key management. For Twenty Cloud, encryption is managed by Twenty using AWS infrastructure in Frankfurt, Germany.

Data Deletion and Soft-Deletes

GDPR Article 17 (right to be forgotten) requires you to delete data on request. Twenty implements soft-deletes: records are flagged as deleted for 14 days (configurable) before permanent removal. This grace period protects against accidental deletion and allows audit trails. After the retention window, the data is permanently removed from the database. Backups are retained for 30 days and then deleted. Workspace deletion takes 90 days for the production environment plus 90 days for backups.

Audit Logging

Twenty includes built-in audit logs that track who accessed, modified, or deleted data. These logs are critical for proving compliance during regulatory audits. You can query them to answer: "Who viewed customer X's phone number?" or "When was this record deleted and by whom?" Audit trails are the backbone of any GDPR compliance defense.

Data Processing Agreement (DPA)

For Twenty Cloud users, a DPA is available through self-service in workspace settings. The DPA formally designates Twenty as your data processor and sets out obligations around data handling, sub-processors, and breach notification (48 hours). For self-hosted users, you control all processing and do not need a DPA with Twenty (but may need one with your hosting provider).

Sub-Processor Transparency

GDPR requires you to know and approve all vendors who access your data. Twenty's managed offering uses: AWS (infrastructure), Cloudflare (CDN), Stripe (payments), and Sentry (error monitoring). Each of these has a sub-processor agreement with Twenty. This transparency is built into the platform; you can see the list in Twenty's trust center.

Setting Up Compliance for Self-Hosted Twenty

Self-hosting Twenty gives maximum control but requires operational discipline. Here is the step-by-step setup:

Step 1: Choose a Compliant Hosting Provider

Select a hosting provider in the EU (or a jurisdiction with GDPR adequacy) and request a Data Processing Addendum (DPA). Providers like Hetzner, Scaleway, or AWS EU regions offer DPAs. The DPA confirms that the hosting provider will follow your instructions on data handling and notify you of data breaches. Do not skip this; you need a written agreement.

Step 2: Configure Encryption

Enable encryption at rest. Most hosted providers offer encrypted storage; verify it is enabled in your account settings. Use HTTPS/TLS for all connections. Generate strong database encryption keys and store them securely (not in code, not in git). Rotate keys quarterly as a security best practice.

Step 3: Set Backup and Retention Policies

Define how long you retain backups (30 days is standard for GDPR compliance). Ensure backups are encrypted and stored in the same jurisdiction as the primary database. Document your retention schedule in writing; regulators will ask for it.

Step 4: Configure Access Controls

Implement role-based access control (RBAC): not all employees need access to all customer data. Twenty supports granular permissions; use them. Log all admin access. Restrict database access to named team members only.

Step 5: Document Your Data Flows

Create a data mapping document: what data you collect, why, who accesses it, where it is stored, how long it is retained. This is your Data Protection Impact Assessment (DPIA). It is not required by law, but regulators expect it if you claim compliance.

Operational Compliance Processes

Once Twenty is deployed, GDPR compliance is an ongoing operational practice. These processes must be documented and repeatable.

Handling Data Subject Requests

When a customer asks for their data (Article 15, access request), you must respond within 30 days. Twenty's audit logs and data export tools make this feasible: search the customer record, export their data, deliver it (usually as a CSV or PDF). Document the request date and your response. Keep a log of all requests.

Deletion Requests (Article 17)

A customer asks you to delete their data. In Twenty, soft-delete the record. After 14 days, it is gone. Document the request and deletion date. Inform the customer of completion. This is a legal requirement, not optional.

Breach Notification

If a breach occurs (a hacker accesses customer data), GDPR requires you to notify affected individuals within 72 hours. Have a breach response plan: who to notify internally, what information to collect, how to communicate to affected users. Twenty's audit logs help identify what data was accessed and when.

Collect explicit consent for marketing communications separately from service consent. Twenty CRM can store consent flags and preference data. Ensure consent is documented and timestamp-tracked. This is often the difference between compliant and non-compliant marketing.

Data Retention Reviews

Quarterly, review which data you actually need. Delete test records, old prospects who have not engaged in 2+ years, and any data beyond your stated retention period. This is labor-intensive but non-negotiable for compliance.

Compliance Costs: Self-Hosted vs. Twenty Cloud

The cost of compliance depends on your deployment choice. Here is a realistic breakdown:

Self-Hosted Twenty on a VPS

Infrastructure: $30-100/month (small VPS with backups and daily snapshots). Legal: $500-2,000 (one-time, for DPA review with your hosting provider). Labor: 20-40 hours annually (backup monitoring, access logs, deletion workflows, security updates).

Total year one: $1,000-2,500 plus your labor time. Total year two and beyond: $500-1,200 plus ongoing labor.

You own compliance entirely: the burden is yours. If you have one data breach, you are liable.

Twenty Cloud

Twenty Cloud includes managed infrastructure, daily backups, encryption, and Twenty's SOC 2 certification. Cost: $69-749/month depending on seats and data volume.

DPA: Included (self-service). Audit logs: Included. Encryption: Managed by Twenty. Breach notification: Twenty handles it within their 48-hour SLA.

Total: $828-8,988/year. No hidden legal or labor costs for compliance infrastructure.

Trade-off: You depend on Twenty's security practices and SOC 2 certification. Your data is in AWS Frankfurt. If you need data residency outside the EU or custom encryption key management, self-hosting is your only option.

Opsily Managed Option

Opsily offers managed Twenty CRM hosting on EU infrastructure. You avoid the DevOps burden of self-hosting but retain data residency control. You still own compliance responsibility (policy, DPA, data mapping), but Opsily handles the infrastructure, backups, and security patching.

Compliance Audits and Certifications

What SOC 2 Means (and Does Not)

Twenty Cloud holds SOC 2 certification, an independent audit of security controls (access, encryption, incident response). SOC 2 is not GDPR compliance, but it supports it: it proves Twenty has documented security practices audited by a third party. When you sign a customer contract and they ask, "Are you SOC 2?", you can say yes (if using Twenty Cloud).

Self-hosted Twenty is not certified by a third party. You must manage your own certifications, which usually means: no external certification, but you can conduct your own security assessment or hire an auditor for a few thousand dollars.

What You Must Document

Regardless of deployment, keep:

Copy of your DPA (with hosting provider or Twenty).
Data mapping document (DPIA).
Backup and retention policies.
Incident response plan.
Access control documentation.
Data subject request log (dates, responses).

This is your compliance portfolio. If a regulator (or a customer) asks, "Are you GDPR compliant?", you hand them this portfolio. It is not a badge; it is proof of process.

Frequently Asked Questions

Twenty CRM's code includes GDPR-supporting features (encryption, audit logs, soft-delete, DPA support), but GDPR compliance is not automatic. You must configure these features and operate Twenty according to your privacy policy and DPA. Twenty Cloud is GDPR certified; self-hosted Twenty requires you to implement and maintain compliance operationally.

Twenty Cloud provides managed infrastructure, daily backups, encryption, SOC 2 certification, and a pre-signed DPA. Self-hosted Twenty gives you data residency control and encryption key ownership, but you must manage backups, access controls, and audit logs yourself. Choose cloud for simplicity; choose self-hosted for maximum control and data residency.

Do I need a DPA with Twenty if I self-host?

No. When you self-host Twenty, you are the data processor and controller. You do not have a data processing relationship with Twenty. You may need a DPA with your hosting provider (e.g., if you host on AWS or Hetzner).

Maintain a compliance portfolio: your DPA (or documentation if self-hosted), data mapping, backup retention policy, incident response plan, and access control documentation. If you use Twenty Cloud, include Twenty's SOC 2 report. When a customer asks, share this portfolio.

What happens to my data when I delete a record in Twenty?

The record is soft-deleted (marked as deleted) for 14 days. You can recover it during this window. After 14 days, it is permanently deleted from the database. Backups are retained for 30 days and then deleted. All deletion actions are logged for audit.

Create a data mapping document (what data you collect and why). Choose a hosting provider with a DPA. Set backup and encryption policies. Configure role-based access controls in Twenty. Document your data retention periods. Test your data deletion and data export workflows before going live.

The Bottom Line

GDPR compliance is not a feature; it is an operational practice. Twenty CRM provides the tools (encryption, audit logs, soft-delete, DPA support), but you must use them correctly. For most businesses, Twenty Cloud is the simpler path: you get SOC 2 certification, managed backups, and a pre-signed DPA at a predictable monthly cost. For those needing data residency control or custom encryption, self-hosted Twenty is viable if you are willing to own the compliance infrastructure work and legal overhead.

Start with a data mapping document and a DPA with your hosting provider or Twenty. Then configure Twenty's built-in controls and test your data subject request and deletion workflows. When you are ready to remove the DevOps burden, Opsily's managed Twenty hosting keeps your data in the EU and your compliance on track.