Bitrix24: is it a safe choice for your business?
.jpeg)
Domantas Mozeris
Published Date
Based on sources reviewed on 13 October 2026.
In 2022, Lithuanian retailers removed Zelionaja Marka and other Russian products from their shelves. Yet businesses continue to use Bitrix24, a CRM with Russian roots. [1]
We often hear the name Bitrix when speaking with small and medium-sized businesses. Price, features and ease of use matter when choosing a CRM. Bitrix24 also offers a free plan, making it easy to try. [2]
But a CRM holds more than company records and sales data. It may contain customer contacts, call recordings and emails. It can also hold contracts, proposals and internal team conversations. This is highly sensitive information for a business.
Who can access that information when you use Bitrix?
Here are a few facts worth knowing. They matter whether you are choosing a CRM or already using one. This article looks at the cloud version of Bitrix24.
Russian roots
Bitrix was founded in Kaliningrad in 1998. In 2007, it set up a joint venture with the Russian software company 1C. The Bitrix24 cloud product launched in 2012. This history is also outlined on the company's official website. [3] [4]
Bitrix's connection to Russia is a documented fact. Today, however, different companies offer the product in different markets. To understand who you entrust with your data, you also need to look at the current contracts.
A contract with a Cyprus company. What are its connections?
For customers in many EU countries, the contracting company is Alaio Cloud Limited, based in Cyprus. This is set out in Bitrix24's terms of service. In other markets, the contract may be with a company in the United States, India or Bahrain. [5]
Lithuania, Latvia and Estonia are not included in the standard list of territories assigned to the Cyprus company. Licences in these countries can be purchased through partners. Bitrix24 says partners can also help where direct purchasing is unavailable. [5] [6]
When buying through a partner, check who issues the invoice and who your licence agreement is with. These may be different companies.
What connects the Cyprus company to Russia?
A copy of registry data published by CyprusRegistry lists Dmitry Valyanov as one of Alaio Cloud Limited's directors. The site notes that its information was collected at an earlier point in time. [7]
The ruINN website, which publishes Russian registry data, lists Dmitry Valyanov as holding a 13.3% stake in the Russian Bitrix24 company. The site states that its registry data is current as of 12 October 2026. [8]
These public records show a connection through the same person. A director's role, however, does not establish who owns the Cyprus company.
EU servers. A Russian company in the data processing chain
"Your data is stored in Europe" sounds reassuring. But the server's location does not tell you who can process that data.
Bitrix24's infrastructure document lists AWS servers in Frankfurt and Dublin for its European region. Data for accounts in other regions may be stored in the United States. It is worth checking the location for your specific account. [9]
The same document lists Bitrix Distribution Ltd, Russia, as a technical support sub-processor. [9]
A sub-processor is another company that helps deliver the service and may process customer data. In this case, its listed role is technical support.
This is different from storing an entire database on a Russian server. However, the document does not show which specific data from your account technical support could access. The agreement requires sub-processors to limit access to the data needed for their assigned work. [10]
The agreement allows for data processing in Russia
Section 11.3.1 of the data processing agreement explicitly allows for personal data to be processed in Russia.
The agreement also specifies safeguards, including standard contractual clauses for data protection. In plain terms, the provider allows for this processing and sets out the conditions that apply. [10]
This does not prove that Russian authorities have received customer data. But a promise about European servers is not enough if your business wants to avoid data processing in Russia.
Ukraine has imposed sanctions on the Russian Bitrix24 company
According to OpenSanctions, Ukraine has imposed sanctions on the Russian Bitrix24 company since 15 April 2023. The listed duration is ten years. [11]
In May 2023, Forbes Ukraine and LIGA.net also reported that the service would stop operating in Ukraine from 1 June. Customers received notices saying access to their cloud accounts would end and their data would be deleted. [12] [13]
These facts should be kept separate. Sanctions on a specific company and a service shutdown do not establish a general ban on using the product in other countries.
The Ukrainian case also highlights another part of choosing a CRM: service continuity.
A CRM gradually becomes part of everyday work. It holds customer history. Email, telephony and other systems connect to it. If access disappears, buying another licence is not enough. You need to move the data and get the team working again.
So, is Bitrix24 a safe choice?
Public documents do not give a complete answer about the system's technical security. They do help you understand the provider's connections and the data processing terms you accept.
If it matters to your business that customer data is not processed in Russia, we do not see that guarantee in the Bitrix24 documents we reviewed.
Before deciding, ask the provider or partner:
- Which company will we contract with, and who will process our data?
- Where will the data for our specific account be stored?
- Could a technical support company operating in Russia access it?
- Can we agree that our data will not be processed in Russia?
Get the answers in writing. "Servers in Europe" does not answer all these questions.
If you already use Bitrix, start by reviewing your contract and checking your data export options. You can then decide whether to continue using it or plan a move.
If you still use Bitrix, get in touch. We offer businesses using Bitrix a free consultation on the alternatives that best fit their needs.
Sources
- Lithuanian retailers explain the removal of Russian products, 2022
- Bitrix24 plans and pricing
- Official Bitrix company history
- Inc. on the founding of Bitrix in Kaliningrad
- Bitrix24 terms of service: contracting entities, section 35.3
- Bitrix24 guidance on purchasing through partners
- Alaio Cloud Limited registry data copy on CyprusRegistry
- Russian Bitrix24 company registry data on ruINN
- Bitrix24 infrastructure and sub-processors, updated 30 July 2025
- Data processing agreement, sections 7.2, 11.3.1 and 11.4
- OpenSanctions record of Ukraine's sanctions on the Russian Bitrix24 company
- Forbes Ukraine on the service shutdown, 2 May 2023
- LIGA.net report in English, 3 May 2023
.png)
