YOUR CONTEXT.
YOUR CALL.
CMP42 holds the most sensitive data a company has: who it works with, what was said, what it knows. So the trust posture is part of the architecture, not a policy page. GDPR-native, EU-hosted, zero tracking, self-hostable — and every write attributable.
AGENTS MOVE FAST.
TRUST HAS TO KEEP UP.
A CRM that humans click through fails slowly: a wrong field here, a stale pipeline there. A CRM that agents read and write fails at machine speed. When an agent drafts a hundred follow-ups from your graph, you need to know exactly what it read, what it wrote, and who approved it — and you need to know that the data never left the places you chose.
That is why CMP42 treats trust as a set of structural properties rather than a checkbox list. We collect less by default. We record every write. We keep your data where you decide — on our managed EU tier or entirely inside your own environment.
BUILT ON THE PROTAGX STACK.
GDPR-native
Compliance by construction: lean default models, an audit trail on every write, export and deletion when you leave. AVV / DPA on request.
EU-hosted
The managed tier runs in the EU. CMP42 does not train on your data. Nothing leaves except what you explicitly send to an agent you connect.
Zero tracking
No third-party analytics, no fingerprinting, no session replay — in the product and on this website, which sets no cookies at all.
Self-hostable
Run it yourself on your Postgres and object store. Same binary, same models, same MCP tool surface. On self-hosted, nothing leaves your environment.
Attribution + audit trail
Every write records the human or agent that produced it. Every process run is logged and replayable against a past snapshot.
Versioning
Every object in the graph is versioned. Identities stay stable across schema evolution, so a migration never silently breaks a reference.
AUDIT AN AGENT LIKE A GIT BRANCH.
Security reviews of AI workflows usually stall on one question: what exactly did the agent do? In CMP42 the answer is in the data model, not in a log file someone forgot to keep.
Every surface — MCP tools, REST and GraphQL — shares the same auth model and the same audit trail. There is no side door that skips attribution.
- Versioned objects. Every change to a contact, deal, document or note creates a new version you can inspect.
- Attributed writes. Each write records whether a human or an agent produced it.
- Human-in-the-loop approval hooks. A process step can require a person to sign off before an agent's write lands.
- Replayable runs. Replay any process against a past snapshot and check whether the answer would have been different.
- Validation at write-time. Models reject fields that were never declared, so agents cannot quietly invent data.
- Cost accounting. Token spend is visible per process and per run.
MANAGED OR SELF-HOSTED.
The binary, the models and the MCP tool surface are identical. What changes is who operates the infrastructure.
| Question | Managed EU tier | Self-hosted |
|---|---|---|
| Where does the data live? | EU-hosted, operated by protagx | On your Postgres and object store, in your environment |
| Does CMP42 train on it? | No | No |
| Third-party analytics, fingerprinting, session replay? | None | None |
| What leaves the environment? | Nothing, except what you explicitly send to an agent you connect | Nothing leaves your environment |
| GDPR roles | You are the controller, protagx the processor — AVV / DPA under Art. 28 GDPR on request | You operate the system yourself |
| Availability | Alpha from October 2026 | For Design Partners during Alpha; image published with Beta in Q1 2027 |
COMPLIANCE, STATED HONESTLY.
AVV / DPA. A data processing agreement under Art. 28 GDPR (in German: Auftragsverarbeitungsvertrag, AVV) is available on request for the managed tier. Request the AVV / DPA →
SOC 2. The Alpha is not yet certified. SOC 2 Type II is scheduled for GA in Q3 2027 with a scope of Security, Availability and Confidentiality; the same internal controls run in the Alpha, but there is no external report letter to send yet.
No borrowed badges. We do not display certifications we do not hold, and we do not name customers without their permission. If your procurement process needs something we have not published yet, ask — we would rather answer a questionnaire honestly than decorate a page.
Details on each posture live in the deep dives: the GDPR construction (Art. 6, 15–22, 28), the EU hosting and sub-processor stack (EU data residency) and the zero-tracking policy (zero tracking) — each page states what is true today and what changes at GA in plain language rather than compliance shorthand.
TEST IT WITH REAL DATA.
Design Partners run a real workload during Alpha — which means your security and data-protection questions get answered before you commit production data, on the 15-minute call and in the monthly co-design sessions.