Pipedrive backup security & compliance: GDPR, ISO 27001, NIS2

The shared responsibility problem

Like most SaaS platforms, Pipedrive operates under a shared responsibility model: they protect the infrastructure and the platform's uptime; the data you put in — and the ability to recover it after accidental deletion or a bad bulk edit — remains your responsibility. Auditors know this. That's why "the vendor has backups" doesn't pass an assessment.

Where an independent backup fits your framework

• ISO 27001 (A.8.13) — requires backup copies of information, tested and protected. A dated daily snapshot history is direct evidence.
• SOC 2 (Availability & Confidentiality) — customers' data must be recoverable. An independent, downloadable archive demonstrates you don't depend on a single vendor.
• NIS2 — for in-scope EU companies, backup and disaster recovery are explicit requirements. CRM data is in scope when it supports critical operations.
• GDPR — art. 32 requires the ability to restore availability of personal data after an incident. Your customer records are personal data.

How your backup data itself is protected

• Read-only OAuth — we never see your Pipedrive password, and you can revoke access anytime from your Pipedrive settings.
• Encryption — access tokens and backup archives are encrypted in transit (TLS) and at rest (AES-256).
• EU hosting — snapshots are stored on servers in the European Union.
• No secondary use — your data is used only to provide the backup service. Never analyzed, shared or sold. Deletion on request, as required by GDPR.