Home / AI Service Directory / Attio

Attio

Attio · Productivity · GB · attio.com

Last verified 2026-09-16
Entry services/attio.yaml
Training on your data (default tier)
Not stated for CRM records and AI features; Google data is used only to provide the CRM and follows Limited Use
Retention
Client-uploaded data per the client's instructions; client employee data until the relationship ends, plus statutory periods
Data residency
UK controller; data may be stored or transferred outside the UK and EEA under adequacy or SCCs and the UK IDTA

Vendor data-handling terms

Training on your data (default tier)
Not stated for CRM records and AI features; Google data is used only to provide the CRM and follows Limited Use

The policy does not say whether CRM records or email content are used to train Attio's AI features; client-uploaded data is processed on client instructions.

“- Attio's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.”
checked 2026-09-16
Attio Privacy Policy
Retention
Client-uploaded data per the client's instructions; client employee data until the relationship ends, plus statutory periods
“If we have your personal data because a client has uploaded it to our platform, we shall retain it in accordance with our client's instructions. / If we have received your personal data because you are an employee of a client, we shall retain your personal data until we no longer work with your employer, except where we are required to retain personal data for a particular period of time to comply with legal, auditory, or statutory requirements, including requirements of HMRC in respect of financial documents.”
checked 2026-09-16
Attio Privacy Policy
Data residency
UK controller; data may be stored or transferred outside the UK and EEA under adequacy or SCCs and the UK IDTA
“Some or all of your personal data may be stored or transferred outside of the United Kingdom (UK) or European Economic Area (the EEA), including for example, if our email server is located in a country outside the UK or EEA or if any of our service providers are based outside of the UK or EEA.”
checked 2026-09-16
Attio Privacy Policy

Domains and endpoints

observed means seen in Unseen deployments; vendor-documented means listed by the vendor. Vendors do not publish complete lists.

HostRoleSource
attio.comappobserved

Assessment

CRM with AI features: medium

Reasoning: A CRM that syncs mailboxes and calendars and layers AI on top. UK controller, processor-style retention for client data, no explicit statement on AI training. The mailbox sync means the whole inbox is in scope, which is the main exposure.

Flags: AI training on CRM and email content not addressed · Full mailbox and calendar sync · Assessed 2026-09-16. The assessment is Unseen's; the terms above are the vendor's.

Changelog

  • 2026-09-16Documented. Google data, retention and transfer terms verified against the Attio privacy policy.
  • 2026-09-15Listed from the Unseen catalogue with observed domains.

Corrections

Pull request on GitHub, or the form below. Changes are reviewed and recorded in the changelog.

Edit on GitHub