Xurrent

GDPR overview

GDPR compliance is claimed explicitly, on a dedicated compliance page, though that page is dated 25 May 2018 and shows no later revision. Concrete measures do exist: a downloadable Data Processing Addendum (version 27), a subprocessor list published through the Trust Center, and a Data Protection Officer reachable by post in Austin, Texas, and at privacy@xurrent.com. Xurrent, Inc. is certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. DPF, with the Federal Trade Commission as supervisory authority and free recourse through JAMS arbitration. Product features back this up: anonymisation for right-to-be-forgotten requests, customer-defined retention, anonymous login for whistleblowing, and an audit trail. No Article 27 EU representative is designated. The privacy policy takes effect on 10 June 2026; the terms of use were updated on 14 August 2026.

Who owns the data?

Xurrent's security documentation states plainly that customers own the data they store in the service and are free to export it at any time. Xurrent classifies itself as a data processor with respect to customer data, and as a data controller for account data and website visitors; the customer remains the controller of its own Customer Data. Xurrent says it does not sell, rent or trade Customer Data. Individuals wanting to exercise rights over data held in the service must approach the customer, not Xurrent. One caveat: in a merger, acquisition or bankruptcy, personal data may sit among the assets transferred.

Reuse rights

Customers keep control of their own data. They can export it at any time and they define their own rules for storing, accessing, modifying, deleting, sharing and retaining Customer Data, without asking Xurrent's permission. On the vendor's side the declared uses are narrow: providing, maintaining and improving the service, handling security or support incidents, complying with the law, and whatever the customer authorises in writing. Xurrent states it never uses Customer Data, or information derived from it, for marketing or advertising, and that no special categories of sensitive data are collected. AI interactions are said to stay inside the tenant, running on AWS Bedrock with strict isolation and never feeding model training. Website visitor data is a separate matter: cookies, web beacons, HTML5 local storage and server logs serve site improvement, marketing measurement, technical diagnostics, responses to enquiries and event billing, and Do Not Track signals are not honoured for want of an agreed standard. Aggregated or anonymised data falls outside the scope of the policy.

Data retention & training

Hosting summary

Xurrent hosts exclusively on AWS and states that it has no physical access to the data centres. All Customer Data stays within the processing region the customer selects: the European Economic Area, the United Kingdom, Switzerland, Australia or the United States. The vendor says it prohibits any storage or transfer of Customer Data outside that region, while other information, such as account data and marketing logs, may be transferred to the United States. Within the chosen region, data is replicated across several distinct physical locations, with daily and weekly backups held in the primary region and a restoration test every six months. Everything is encrypted at rest, including databases, search indexes, files, memory caches, logs, backups and disks, and TLS 1.3 is used internally. External audits underpin the ISO 27001 and ISO 27018 certifications, the SOC 2 Type II report available on request and the C5 attestation. Note that the marketing website's own IP address resolves to Dublin, Ireland, on Amazon infrastructure; that describes the public site, not necessarily where a given tenant's service runs.