Security & data: Kepler

Your data, your server

Kepler runs on your own infrastructure. Customer data does not sit in a foreign, possibly non-European cloud, but where you decide. Your data belongs to you, and you operate Kepler yourself under a perpetual licence.

Control access finely

Roles and permissions apply down to the detail: you define who may see, edit, delete or only read contacts, differently per area. So each person sees exactly what they need for their work.

Traceable & GDPR-compliant

Changes are logged (audit log), transfers are encrypted. Because the data sits with you and access is controlled, Kepler can be operated in compliance with data protection law; for maintenance access involving personal data we conclude a DPA under Art. 28 GDPR.

Why this gives you peace of mind

A CRM in particular contains the most valuable thing a business has: its customer relationships. That this data stays in your own house and access is clearly regulated is no detail but responsibility, built in here.

Sign-in & retention

Every sign-in is additionally secured by a two-factor code: a 6-digit code by email, “stay signed in” lasts at most 30 days. Submissions can be given a retention period per form. Once it expires they are removed automatically, including files, while your contacts remain. Tenant separation is checked and hardened in regular security reviews, most recently in July 2026.