What CiviCRM actually does with your data

What AI is in it?

• No AI in the product itself. I read every monthly release of CiviCRM from May 2025 to July 2026 and found no AI features in the core software. Nothing arrives quietly with an update the way it does in commercial tools, because there is no vendor pushing features at you.
• DocBot, which reads the manual and not your data. An optional extension that answers questions about how to use CiviCRM. It is trained on the public documentation and community forums, not on anything in your database. It has not been updated since March 2024.
• If you host it yourself, AI arrives only when someone installs it. On a CiviCRM your organisation or your agency runs, nothing AI shaped appears unless a person puts it there, usually by wiring the CRM to an outside AI service through an automation platform. That is a decision with a date and a name attached to it, which is a different situation from every hosted product here.
• If someone hosts it for you, they decide what gets added. On a hosted CiviCRM you are back to having a vendor, and the usual questions come back with it. There are several to choose from, including one run by the CiviCRM project itself and a number of UK agencies. The one with published AI plans so far is CiviPlus, run by Compuco, which is openly building an assistant called CiviAI into it.

Where is your data processed?

Wherever you host it.

CiviCRM lives wherever your installation lives: a server your organisation controls, or more commonly a hosting partner or agency's cloud. The where question therefore has a genuinely knowable answer, but only your host can give it to you. Many charities inherited a CiviCRM set up by an agency years ago and have never asked.

If you are on CiviPlus it is already answered. Compuco says CiviPlus data is hosted on Amazon Web Services, by default on their UK servers. Its G Cloud listing declares data storage and processing locations as the United Kingdom, and the agreement that governs your CRM data limits transfers to the UK and the European Economic Area.

One wrinkle if you go reading for yourself. The general privacy policy on Compuco's websites, last updated in 2021, still says you consent to storage in the United States. That page covers website visitors rather than your CRM, and the documents above are the ones that govern your data, but it is the kind of thing that stops you mid read.

Free versus paid: No tiers, no rollout. The software itself has no plans, no paid AI add on, and no feature arriving one morning because a vendor shipped it. If you are on a hosted product that changes: your provider decides what gets added and when, on their schedule rather than yours. CiviAI, the furthest along of the hosted assistants, is described by its own makers as far from production ready, so for most charities this is a question to ask before it arrives rather than after.

What does this mean for the people you support?

Start by working out which CiviCRM you have, because the two are genuinely different positions.

If your organisation or your agency hosts it, full control means full responsibility: there is no vendor promise to lean on and no vendor to blame, and the whole story is your host, your extensions and your integrations. If you buy a hosted product instead, you have a vendor again, and the fact that CiviCRM underneath is open source does not change what that vendor may add on top.

Either way this is a CRM full of donors, beneficiaries and case detail, so it is worth the half hour it takes to find out.