Where Bitrix24 AI Processes Your Data and How to Stay Compliant

Who Processes What: Bitrix24, Your Company, and the AI Providers

Under every major data-protection framework, your company is the data controller - you decide what personal data enters the CRM, and you bear responsibility for any onward transfers to AI processors and sub-processors, including the AI providers behind CoPilot.

The Bitrix24 vendor acts as the data processor for your account data. This relationship is governed by the Bitrix24 Data Processing Agreement (DPA, dated 29 November 2024), which designates the vendor as processor and your organisation as controller. The DPA explicitly references GDPR and LGPD compliance obligations but does not name the UAE or Saudi PDPL by name - a gap worth raising with your legal team.

The contracting entity varies by geography (per Bitrix24 Terms, last updated 17 August 2026):

This matters because your DPA, standard contractual clauses (SCCs), and transfer mechanism must match the entity you actually contract with.

Where is Bitrix24 account data hosted?

Bitrix24 cloud account data is hosted on AWS in one of two regions: US East (N. Virginia) for .com and .com.br accounts, and Frankfurt, Germany (EU) for .eu, .ae and other European-zone accounts - so the hosting region of your CRM data depends on which domain your portal runs on.

According to the Bitrix24 GDPR page and the infrastructure sub-processor list (last updated 30 July 2025):

• .eu, .ae and European-zone portals - hosted inside the EU, Frankfurt, Germany (AWS)
• .com and .com.br portals - hosted in the United States (AWS N. Virginia), subject to EU-US Data Privacy Framework self-certification

One important nuance: customers in Spain and Portugal are served from the US region, not Frankfurt, per the sub-processor list. Commercial customers can request a transfer to EU data centres through Bitrix24 helpdesk.

The ISO 27001 and SOC certifications listed on the Bitrix24 security page belong to AWS, not to Bitrix24 itself. Keep this distinction clear when presenting compliance evidence to auditors.

For organisations that need data to remain within a specific country's borders, self-hosted deployment on your own infrastructure is the only option that achieves that - see UAE PDPL and Data Residency: Which CRM Keeps Your Data In-Country? and Saudi Arabia Data Residency: Self-Hosted Bitrix24 for PDPL Compliance for region-specific analysis.

Where does CoPilot send your data and to which providers?

When any employee uses CoPilot, the text or audio content of their request is transmitted to a third-party AI provider - per the official AI Tools Terms of Use, OpenAI processes text requests in the USA; this transfer happens regardless of which AWS region hosts your Bitrix24 account.

The Bitrix24 AI Tools Terms of Use (last updated 7 August 2026) state this explicitly:

• "CoPilot operates using AI Technologies provided by third-party AI Providers" (clause 1.1)
• "Any Request You submit will be transmitted to the USA for processing by this AI Provider" - for OpenAI (clause 8.1)
• The data you provide is processed directly by the AI technology, not by the Bitrix24 vendor (clause 1.3)

According to the official provider list (updated 5 August 2026), the current providers are:

You can check the active provider for any CoPilot interaction: go to Messenger - CoPilot chat - tap the chat name - Provider. This is documented at helpdesk article 25850687.

What Is Stored and for How Long

The official CoPilot FAQ (updated 7 May 2026) states: "Bitrix24 stores your data for up to 14 days for technical purposes and then deletes it." CoPilot chat history is also saved within your account.

Critically, the AI Tools Terms (clause 6.1) note that "AI Providers may use Your Content, including for the purposes of provision, maintenance, development, and improvement of their AI Technologies" - meaning the content of prompts may be used by providers under their own terms. Do not represent to your data subjects or auditors that their data is never used for model training; instead, point to the provider's own data-use policies.

The Bitrix24 vendor itself receives a "perpetual, worldwide, non-exclusive, royalty-free licence" to use Requests and Content for providing, maintaining and improving AI Tools (clause 5 of the Terms).

AI Is Active by Default

The Terms also state (clause 1.3): "NO ADDITIONAL ACTION IS REQUIRED FROM USERS TO ENABLE AI TOOLS" and AI agents may be active from account creation. Call transcription may begin running from the first use of the function (clause 7.2). Your customers and employees may be subject to AI processing before any deliberate decision has been made at the IT or compliance level.

How to Control CoPilot - Turning It On, Off or Restricting It

An administrator can restrict or disable CoPilot features from Settings - CoPilot preferences, where they can choose which tools use text or image generation, enable or disable CoPilot in CRM, allow or block CoPilot chat, and select the AI provider; only administrators can change these settings.

Per the official control guide (updated 23 September 2026) and the FAQ:

• By default, all employees can use CoPilot
• Settings - CoPilot preferences gives administrators granular control per feature area
• External AI via MCP is off by default and must be explicitly enabled by an administrator

If you need to switch off AI for a specific use case (for example, call scoring in jurisdictions where employee monitoring AI triggers legal review), this is the path to do it.

For details on what AI call analysis actually does and how to configure it, see AI Call Analysis in Bitrix24: Transcription, Quality Scoring, and Sales Coaching.

CoPilot on Self-Hosted Bitrix24 - Prompts Still Leave the Server

Even on a self-hosted (on-premise) Bitrix24 installation, CoPilot prompts are not processed locally - they leave your server and travel to Bitrix24 AI proxy addresses, and from there to third-party providers; there is no officially documented option to run CoPilot against a local model on-premise.

According to the official self-hosted AI guide (updated 19 May 2026), enabling CoPilot on-premise requires:

• Platform version 24.700.0 or later
• The AI Integration module installed
• Outbound network access to the Bitrix24 AI proxy hosts (ai-proxy-de.bitrix.info and two related addresses)

This means the data-residency argument for self-hosted does not automatically extend to CoPilot queries. The cloud REST method to register a custom AI engine (the ai.engine.* API) exists only for cloud accounts and is not available on-premise in the documented feature set.

For organisations that need all AI inference to stay within their own network perimeter, the practical options are:

1. Disable CoPilot entirely via administrator settings
2. Build custom integrations that call your own OpenAI-compatible endpoint (such as a corporate vLLM or Ollama server) using Alaio Vibecode BYOK or a custom REST integration built by a partner
3. Use Alaio Vibecode with your own key - noting that Vibecode requests go through the Vibecode proxy with logging, and the processing region of BitrixGPT 5.5 is not publicly documented

For a broader look at what self-hosted customisation makes possible, see Customizing Beyond Cloud Limits: What Becomes Possible with Self-Hosted Bitrix24.

The architecture below shows how CoPilot requests flow through Bitrix24 cloud and self-hosted deployments, and where third-party AI processing occurs.

A Bitrix24 employee request passes through either the cloud account or the on-premise server, then exits to Bitrix24 AI proxy infrastructure, and from there to the third-party AI provider (typically OpenAI in the USA) before the response returns to the user.

Which regulatory requirements apply to Bitrix24 AI in your region?

Transferring personal data to a US-based AI provider triggers cross-border transfer obligations under GDPR (Art. 44-46), UAE PDPL (Art. 22-23), KSA PDPL (Art. 29), and Brazil's LGPD (Art. 33) - your compliance posture for each must be assessed before enabling AI features on customer or employee data.

GDPR (EU / EEA)

GDPR Article 28 requires that sub-processors be authorised in writing, and Articles 44-46 require a valid transfer mechanism (adequacy decision or SCCs) for data leaving the EEA. The Bitrix24 DPA addresses GDPR and includes provisions for new sub-processors (at least 10 days' notice where GDPR applies). Review the sub-processor list carefully - it includes AI providers and support and telephony providers in several countries outside the EU.

EU AI Act

Regulation (EU) 2024/1689 entered into force 1 August 2024. Key dates for Bitrix24 users:

• 2 Feb 2025 - prohibited practices and AI literacy obligations applied
• 2 Aug 2025 - general-purpose AI rules applied
• 2 Aug 2026 - Article 50 transparency obligations applied (people must be told they are interacting with an AI system; AI-generated content must be marked)
• 2 Dec 2026 - generative systems placed on the market before 2 Aug 2026 must meet Article 50(2) marking requirements

The Act was amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI, published 24 July 2026): high-risk obligations under Annex III move to 2 December 2027, and Annex I systems to 2 August 2028. Importantly, Annex III point 4(b) classifies AI used "to monitor and evaluate the performance and behaviour of persons" in work relationships as high-risk. Using CoPilot's call-scoring feature to evaluate employee performance may require a formal legal assessment before deployment.

UAE PDPL

Federal Decree-Law No. 45 of 2021 (in force 2 January 2022): Article 22 permits cross-border transfers to countries with adequate protection approved by the UAE Data Office; Article 23 allows exceptions including contracts and the data subject's express consent. The Bitrix24 DPA does not name the UAE PDPL, so UAE customers should obtain separate legal advice on whether the DPA's SCCs and transfer mechanisms satisfy local requirements. Free zones with their own data protection laws (DIFC, ADGM) fall outside the UAE PDPL's scope and have their own frameworks.

KSA PDPL

The Saudi PDPL and its Regulation on Personal Data Transfer outside the Kingdom require that transfers do not affect national security, provide an adequate level of protection, and are limited to minimum necessary data. Safeguards include standard contractual clauses and binding corporate rules. Controllers must conduct a risk assessment before any cross-border transfer - which the transfer of CoPilot prompts to OpenAI in the USA would constitute.

Brazil LGPD

Lei 13.709/2018 Article 33 allows international transfers only in listed cases, including SCCs and specific highlighted consent. Article 20 establishes the right to review automated decisions. ANPD Resolution CD/ANPD 19/2024 (published at gov.br/anpd) approved standard contractual clauses for use under LGPD. The Bitrix24 DPA references LGPD compliance, but verify which SCCs apply to CoPilot sub-processors specifically.

For a deeper comparison of how self-hosted deployment addresses GDPR requirements, see GDPR-Compliant CRM: Why Self-Hosted Bitrix24 Wins for EU Companies.

AI Scenario Compliance Matrix

The table below maps the main CoPilot use cases to the processors involved and the primary compliance questions to resolve.

Related: Enterprise AI in Bitrix24: Rolling Out CoPilot Across a Large Company

Related: EU AI Act and CRM AI: What Companies Using Bitrix24 Need to Do in 2026-2027

Pre-Deployment Compliance Checklist

Before enabling CoPilot or AI call analysis on live customer or employee data, work through the following steps.

Legal and contractual:

• Confirm your DPA with the Bitrix24 vendor covers the AI sub-processors you will use (review the sub-processor list)
• Identify the legal basis for cross-border transfer under your applicable law (GDPR SCCs, UAE PDPL Art. 22/23, KSA PDPL risk assessment, LGPD Art. 33 SCCs or consent)
• Update your privacy notice to disclose AI processing and the identity of AI sub-processors
• Verify your contracting entity matches your region (the Bahrain entity for UAE/KSA, the US entity for Brazil, the Cyprus entity for Portugal)
• For EU deployments: assess whether any CoPilot use case qualifies as high-risk under EU AI Act Annex III - especially employee performance scoring
• For call recording and transcription: confirm that local call-recording consent requirements are met before enabling call transcription

Technical and operational:

• Review CoPilot preferences in Settings and disable features that are not needed or not yet assessed
• Restrict CoPilot access to roles that genuinely need it (by default all employees can use it)
• Brief all users who will use CoPilot on what data they may and may not include in prompts (no unnecessary special-category data - health, financial, biometric)
• Verify that automations (robots, triggers, smart processes) do not feed sensitive personal data fields into CoPilot blocks without a specific need
• Enable two-factor authentication for all users with access to personal data
• Maintain a CRM access audit log (who accessed which records and when)
• For self-hosted: confirm whether outbound access to Bitrix24 AI proxy hosts is open, and make a deliberate decision about whether that is acceptable under your security policy
• Check the active AI provider per feature (Messenger - CoPilot chat - Provider) after any Bitrix24 platform update, as providers may change