As a CRM provider, security is a top priority for us.
Our customers host sensitive business data on our platform, and that requires a high level of trust. This page explains the measures we take to protect your data and your privacy.
This is a non-exhaustive overview. For detailed contractual commitments, please refer to our Data Processing Agreement (DPA). If your compliance team needs additional information or formal documentation, contact us at security@folk.app.
Certifications & compliance
SOC 2. SOC 2 is a security framework published by the AICPA (American Institute of Certified Public Accountants). It requires an independent auditor to verify security controls across technology, organization, HR, and fraud management.
folk has completed its SOC 2 Type 1 audit and is pursuing SOC 2 Type 2. A Letter of Attestation is available to customers upon request, and the full SOC 2 report can be shared under NDA.
CASA. We complete the Cloud Application Security Assessment (CASA) audit annually through Google's App Defense Alliance. This assessment validates how we handle data accessed through third-party APIs, including Google and Microsoft integrations.
Internal standards. As part of our ongoing security practices, we benchmark against PCI DSS v3.2.1 Level 1 and AWS Foundational Security Best Practices through AWS Security Hub. We also conduct AWS Well-Architected Framework reviews twice a year.
GDPR compliance
folk is committed to complying with the General Data Protection Regulation (GDPR), Regulation (EU) 2016/679, and applicable French data protection legislation, including the French Data Protection Act (Loi Informatique et Libertés).
Our Data Processing Agreement defines our respective responsibilities when processing personal data.
Our role in processing personal data
When customers use folk to manage their contacts and communications:
The customer acts as the Data Controller, determining the purposes and means of processing personal data.
folk acts as the Data Processor, processing that data on the customer's behalf and according to documented instructions.
Where folk processes personal data for its own purposes, it acts as a Data Controller and assumes the corresponding legal obligations.
Your data protection rights
Under the GDPR, individuals have rights relating to their personal data, including access, rectification, erasure, objection, and data portability, where applicable.
When folk processes personal data on behalf of a customer, we assist that customer in responding to requests from data subjects.
Our DPA specifies that folk will take relevant measures and provide a written response to the customer within fifteen (15) days of receiving a request forwarded by the customer, where applicable.
If an individual contacts folk directly regarding data controlled by one of our customers, we forward the request to the relevant customer as soon as possible and act according to their instructions.
For privacy-related requests concerning data for which folk is the Controller, contact privacy@folk.app.
Data hosting & international transfers
Where your data is hosted
folk's platform servers are located in Ireland, within the European Union, as specified in Article 9 of our Data Processing Agreement.
Our infrastructure is hosted on Amazon Web Services (AWS), which provides the hosting environment for our platform, databases, and storage.
We use appropriate technical and organizational measures to protect the confidentiality, integrity, and availability of the personal data entrusted to us.
International data transfers
While our platform servers are located in Ireland, some of our authorized sub-processors operate outside the European Union, including in the United States.
When personal data is transferred outside the EU, folk commits to implementing appropriate safeguards in accordance with Articles 45 and 46 of the GDPR.
We maintain a list of sub-processors, including their respective locations and processing purposes, in Appendix 2 of our DPA.
If there are changes to the countries where data is processed, we inform customers in accordance with our contractual commitments.
How we handle your data
We never sell your personal data, and we never use customer data to train AI models.
We process personal data for the purposes necessary to deliver our services, including:
Storing, organizing, and displaying contacts.
Helping customers manage relationships and communications with their contacts.
Centralizing and updating contact information.
Segmenting contacts and facilitating follow-up activities.
Connecting customer applications and third-party services, such as Gmail and Outlook.
Providing enrichment, search, automation, and other product functionality.
The personal data processed through our platform may include:
Contact information: Names, email addresses, and other contact details provided or connected by customers.
Correspondence data: Emails, associated metadata, and communication history.
Technical information: Information necessary to operate, secure, and maintain our services.
When acting as a Data Processor, folk processes personal data only for the purposes described in our DPA and according to the Controller's documented instructions, unless otherwise required by applicable law.
We also apply data protection by design and by default in developing our products and services.
Sub-processors & third-party services
We work with carefully selected third-party providers to deliver specific functionalities, including hosting, search, contact enrichment, communications, billing, customer support, and automation.
Our authorized sub-processors include AWS, OpenAI, Google Workspace, Microsoft 365, Intercom, Stripe, and other providers identified in Appendix 2 of our DPA.
Each sub-processor is required to provide appropriate technical and organizational security guarantees and to comply with applicable data protection obligations.
Changes to sub-processors
In accordance with Article 8 of our DPA:
We inform customers in writing in advance of the addition or replacement of sub-processors.
The notification identifies the new sub-processor and the processing activities entrusted to them.
Customers have ten (10) days from receipt of the notification to raise objections.
The proposed sub-processing may proceed if no objection is raised within the agreed period.
folk remains responsible to its customers for the performance of its sub-processors' contractual obligations.
The full list of sub-processors and their processing locations is available in Appendix 2 of our Data Processing Agreement.
Email & calendar integrations — data scope
When customers connect their Google or Microsoft accounts, folk requests permissions necessary to provide the corresponding integrations.
Google integrations
Depending on the features enabled, the permissions described in our DPA include:
Access to contacts stored in Google Contacts.
Read access to Gmail messages and associated metadata, including labels and history records.
Read-only access to Google Calendar events.
Permission to send emails through the connected Gmail account.
Microsoft 365 integrations
The permissions described in our DPA include:
Access to contacts in the connected Microsoft account.
Read access to emails and associated metadata.
Read access to calendar events.
How email data is handled
When a mailbox is connected, folk processes email messages and associated metadata to centralize communication history and display interactions alongside relevant contacts.
This can include email message bodies and the metadata necessary to associate conversations with contacts.
Email data is encrypted at rest and in transit.
There is currently no setting to store email metadata only.
Customers can disconnect their email integrations and manage the corresponding data through the available product functionality and applicable data deletion procedures.
AI features & your data
Every AI feature can be turned off. Data used by our AI features is processed through OpenAI's APIs and is never used to train models. Other enrichment providers, such as Perplexity, can be disabled entirely in your settings.
Our technical platform
Our platform is hosted on Amazon Web Services (AWS), with platform servers located in Ireland (EU).
We follow AWS security and infrastructure recommendations to support service continuity, resilience, and availability.
Access to our production environment is restricted to authorized technical personnel.
Each authorized team member authenticates using individual credentials, with multi-factor authentication enforced and password rotation every 90 days.
Before engaging third-party service providers, we assess their security practices and ability to meet our requirements.
Application & infrastructure security
Network protection. We use AWS Web Application Firewall (WAF) to protect our application infrastructure against common web-based threats.
Hardened, immutable servers. Our servers run read-only Docker images built through our continuous integration pipeline, reducing the risk of unauthorized changes to running environments.
Vulnerability management. AWS Inspector scans container images during the build process. Security findings are reviewed weekly, and remediation is prioritized according to severity.
Encryption. Personal data is protected through encryption at rest and in transit.
Availability & resilience. We implement measures designed to ensure the ongoing confidentiality, integrity, availability, and resilience of our processing systems.
Recovery & testing. We maintain measures to restore access to personal data following physical or technical incidents, and regularly test and evaluate our security controls.
Other security practices. Our security program includes component isolation, automated deployments, updates, continuous monitoring, audits, access controls, data classification, backups, asset lifecycle management, and employee security training.
These measures support our commitments under Article 32 of the GDPR and Article 6 of our DPA.
Internal security process
Our internal security practices draw on recognized cybersecurity frameworks, including the NIST Cybersecurity Framework and guidance issued by ANSSI, France's national cybersecurity agency.
We maintain:
Cybersecurity risk assessments and remediation plans.
Documented disaster recovery procedures.
Security awareness and training materials.
Employee onboarding and offboarding procedures.
Processes for incident management and vulnerability remediation.
Documentation of processing activities and security measures.
We also cooperate with customers where necessary for data protection impact assessments and regulatory consultations, as provided in our DPA.
Authentication & access management
Rather than using a traditional idle-session timeout, active sessions are revalidated every two minutes and remain valid for a maximum of 90 days, after which re-authentication is required.
Physical access to our offices is controlled through appropriate security mechanisms, including badges and secure keys.
For logical access to internal tools, we apply two principles wherever supported:
Multi-factor authentication.
Individual user accounts rather than shared credentials.
HTTP access logs are archived for security, legal, and investigation purposes, subject to applicable retention requirements.
Access to personal data is restricted to authorized personnel who are subject to confidentiality obligations and receive appropriate training.
Data retention & deletion
Data retention during the subscription
In accordance with Article 2 of our DPA, personal data processed on behalf of customers is retained for the duration of the agreement, subject to applicable contractual and legal requirements.
Data handling after termination
Under Article 7 of our DPA, when the agreement ends, folk undertakes, depending on the customer's choice, to:
Delete the personal data processed on their behalf; or
Return the personal data to the customer, or to a processor designated by the customer, in a commonly used, readable, or interoperable format.
When data is returned, existing copies in folk's information systems are also destroyed in accordance with the DPA, subject to applicable legal retention obligations.
Legal retention exceptions
Certain personal data may be retained where necessary to comply with legal obligations, including accounting requirements, or for the establishment, exercise, or defense of legal claims.
Where such retention is necessary, the relevant data is kept in a restricted-access archival database, and the customer is informed of the applicable retention period.
Customers can request account deletion or information about their data by contacting privacy@folk.app.
Safety of your data & incident response
Protecting customer data is fundamental to our security program.
Our systems use encryption and secure communication protocols to reduce the risk of unauthorized access, disclosure, or loss of personal data.
We maintain an incident response process to identify, contain, investigate, and remediate potential security incidents.
Personal data breach notifications
In accordance with Article 5 of our DPA, folk will notify the affected customer without undue delay after becoming aware of a personal data breach, by sending an email to the customer's Data Protection Officer (DPO).
Where possible, our notification will include:
The nature of the personal data breach.
The approximate number of affected data subjects and records.
The potential consequences of the breach.
The measures taken or proposed to address the incident and mitigate its consequences.
We provide relevant documentation and assistance to help customers fulfill their notification obligations under Articles 33 and 34 of the GDPR.
When folk acts as a Data Processor, the customer, as Controller, is responsible for notifying the relevant supervisory authority and affected individuals where legally required.
When folk acts as a Data Controller, we fulfill the corresponding notification obligations directly.
Enterprise & vendor security reviews
We support customers conducting vendor due diligence, procurement assessments, and security reviews.
Depending on the request and applicable confidentiality requirements, we can provide:
Our Data Processing Agreement, including applicable processing commitments.
Our list of authorized sub-processors and their processing locations.
Information about our GDPR compliance measures and international data transfers.
SOC 2 documentation under NDA.
Information about our CASA assessments and penetration testing.
Documentation covering technical and organizational security controls.
Information about authentication, access management, data residency, and service availability.
In accordance with Article 3 of our DPA, we make appropriate documentation available to demonstrate compliance with our contractual data protection obligations and facilitate applicable audits and inspections.
To initiate a security review, contact security@folk.app.
For additional information, please refer to our Terms of Service, Privacy Policy, and Data Processing Agreement.
If you have any questions about security or privacy at folk, email us at security@folk.app.
For more information, please refer to our terms of use and privacy policy.
If you have any question on this topic, please email us at security@folk.app