CRM Data Residency in Vietnam: Where Your Customer Data Actually Goes

Most companies cannot say which country their customer records are sitting in right now. Almost none can say where those records go when someone clicks an AI feature. That is an engineering question before it is a legal one, and unlike the legal question it has a definite answer you can go and find today.

This article is about finding it. It covers the four places CRM data travels, what actually happens during an AI call, how to map your own system, and what your lawyer will need from you once you have.

Your Customer Data Has Four Destinations, Not One

When people ask where their CRM data lives, they usually mean the database. That is one of four answers, and on its own it is the least interesting.

1. Primary storage. The database holding your records. This is the one vendors publish and the one procurement asks about. Storage location is usually a documented fact, so start here, but do not stop here.

2. Inference. Where AI features process the record. Summarizing a call, drafting a reply, scoring a lead, classifying an enquiry, enriching a contact. This is frequently a different provider in a different country from the database, and it is very often documented separately from storage, or not documented at all.

3. Human access. Where support engineers, administrators and implementation partners sit when they open a record. A database in one country that is routinely accessed from three others has a wider footprint than its hosting page suggests.

4. Subprocessors. Analytics, enrichment providers, email infrastructure, backup, search indexing, observability tooling. Every one is a destination. Most companies have never enumerated them.

A data flow map that only answers the first question is not a map.

Why This Became Worth Auditing

Vietnam's Personal Data Protection Law, Law No. 91/2025/QH15, has applied since 1 January 2026. Decree No. 330/2026/ND-CP, which sets administrative sanctions in this area, has applied since 19 August 2026 and includes sanctions calculated as a percentage of an organization's prior-year revenue.

One provision is worth quoting because it maps directly onto the four destinations above. Article 20(1) of the Law lists the cases treated as cross-border transfer of personal data. The third is:

Agencies, organisations and individuals in Vietnam or abroad using a platform located outside the territory of Viet Nam to process personal data collected in Vietnam.

We are a technology consultancy, not a law firm, and this article does not tell you what that means for your company. What it does say is that the statutory language is about platforms and processing locations, which are facts about your architecture. Whichever way the legal analysis goes, someone has to establish those facts first, and that is not a job for your lawyer.

The instruments are linked at the end so your counsel can work from the primary texts.

What Actually Happens When You Click the AI Button

This is the part worth understanding in mechanical terms, because the mechanics are what everything else depends on.

A customer record is selected. The application assembles a prompt containing that record, or a portion of it. That prompt is sent over the network to a model endpoint. The endpoint may be operated by your CRM vendor, or by a third-party model provider the vendor has contracted, and it runs wherever that provider runs it. The model reads the prompt and returns text. The application writes the result back into your database.

Three things follow from that sequence, and none of them are legal opinions:

It is a network egress, not a local computation. The record leaves your database, leaves your application, and leaves the network boundary. Whether it also leaves the country depends entirely on where the endpoint is.

It repeats. Unlike a migration, which happens once, this occurs on every invocation. A team of twenty using AI features daily generates thousands of these events a year.

Retention and transmission are different properties. A model provider may commit to retaining nothing. That commitment is about what happens after the request. It says nothing about the request itself, because the model has to receive the input in order to produce the output.

Whether transient processing of that kind is treated the same way as storage under Vietnamese law is a question we are not going to answer for you. Published official guidance addressing inference specifically does not yet exist, and it is exactly the sort of question to put to counsel. But notice that the question cannot even be asked properly until you know which country your model endpoint is in, and most companies do not.

How to Map Your Own Data Flows

This is a half-day exercise for one engineer with the right access, and it produces a document your lawyer can actually use.

Inventory the destinations. For every system holding customer data, list the primary database, the AI or model endpoints, the support access paths and the subprocessors. The vendor's subprocessor list is usually published and usually longer than people expect.

Read the vendor's own hosting documentation, not a summary. Every major platform publishes its data hosting locations. Establish which countries are listed, and whether Vietnam is among them.

Check inference separately from storage. These are documented in different places and the answers are often different. If the AI features are not covered by the storage documentation, ask the vendor in writing.

Distinguish regional hosting from residency. An account served from a nearby region is still served from outside Vietnam. They are different questions and should be recorded as different answers.

Tie every answer to your actual configuration. Not to the vendor's global privacy program, but to the specific product, subscription tier and account settings you are running, in writing.

Write it down as a table. Destination, country, what it processes, evidence, date checked. That table is the deliverable.

What Your Lawyer Will Ask, and Why You Probably Cannot Answer It

Whatever your counsel concludes about your obligations, the analysis will require inputs from your side. In our experience the questions come in this order, and companies stall on the second one.

Which categories of personal data do you hold. Which systems hold them and in which countries. Who can access them and from where. Which processing is automated and where that automation runs. Which of these arrangements changed in the last twelve months.

The first question is a business question. Every one after it is an architecture question, and it is normally the point at which a compliance project discovers that nobody has a current diagram of their own systems. The legal analysis is not the bottleneck. The data flow map is.

A general assurance from a vendor that it is compliant with a European regime is also not an input to this. It is a statement about a different framework, and your counsel will treat it as such.

What This Looks Like in Vietnamese Manufacturing

We work with manufacturers across Vietnam on production systems, and the pattern in the commercial function is consistent with what AI is actually running in Vietnamese factories. The shop floor is generally well instrumented and well governed. The office that sells its output is often neither.

Production data usually stays on premises, in an MES and sometimes an on-site ERP, under the plant's control, because uptime and intellectual property protection demanded it long before any privacy law did. Those systems have diagrams. Somebody owns them.

The same company will then run its customer relationships through a cloud CRM hosted elsewhere, with AI features switched on, and no equivalent diagram exists for any of it.

That asymmetry is an inherited assumption: that the factory is the sensitive part and the sales office is administrative. It is worth revisiting, because the sales office is where the personal data is.

Five Questions to Ask Any CRM Vendor

These are procurement and architecture questions. They are answerable, verifiable, and they are what turns a vendor conversation into evidence. Ask them of any vendor, including us.

1. 1. Where is the data stored, and can we change it? Not which regions exist, but which country holds our Vietnamese customer records today, and whether we can move them without changing vendor.
2. 2. Where does inference happen? Can the AI features run on infrastructure we control, or do they require a call to a model provider elsewhere?
3. 3. Can we self-host? If the only deployment model is the vendor's own cloud, then where the data lives and where inference happens are the vendor's commercial decisions rather than ours.
4. 4. Can the system produce an audit record? Who accessed what, when, and where it went. Without an append-only audit log, the data flow map has gaps you cannot close.
5. 5. Can we verify any of this? A security whitepaper is an assertion. Source code, deployment documentation and a published architecture are evidence.

Question three is the one that decides the first two. Deployment models differ between vendors, and it is worth establishing which one you are buying before the other answers matter.

Where We Landed

We put the same five questions to our own stack, did not like the answers, and built the CRM we needed.

Margince is an AI-native CRM built by Gradion. It runs as SaaS, on your own servers, or fully local including the language model, for teams whose data cannot leave the building. It is source-available under BUSL-1.1, so the answers to all five questions above can be verified rather than taken on trust. Every agent action is written to an append-only audit log, and actions that carry consequence stop and wait for a named human to approve them. An AI agent never holds more rights than the person behind it and can never approve its own work.

We are replacing our own HubSpot instance with it first. If it cannot carry Gradion's pipeline, it does not ship.

Margince is in Early Access ahead of an Autumn 2026 release.

The Primary Texts

Official versions published by the Vietnam Government Portal:

• Law No. 91/2025/QH15 on Personal Data Protection: https://datafiles.chinhphu.vn/cpp/files/vbpq/2025/7/91qh.signed.pdf
• Decree No. 356/2025/ND-CP: https://datafiles.chinhphu.vn/cpp/files/vbpq/2026/01/356-nd.signed.pdf
• Decree No. 330/2026/ND-CP: https://datafiles.chinhphu.vn/cpp/files/vbpq/2026/8/330_2026_nd-cp_19082026-signed.signed.pdf
• Decree No. 13/2023/ND-CP: https://datafiles.chinhphu.vn/cpp/files/vbpq/2023/4/13nd.signed.pdf
• Decree No. 53/2022/ND-CP: https://datafiles.chinhphu.vn/cpp/files/vbpq/2022/08/53-cp.signed.pdf

The passage quoted in this article is Article 20(1)(c) of Law No. 91/2025/QH15. Effective dates are stated at Article 38(1) of the Law and Article 80 of Decree No. 330/2026/ND-CP.

FAQ

Where is my CRM data actually stored?

Most vendors publish their data hosting locations. Check the vendor's own documentation for the specific product and subscription tier you use, and record which countries are listed.

Is CRM data storage the only thing to check?

No. Customer data typically reaches four destinations: primary storage, AI or model endpoints that process records, human access by support and administration, and subprocessors such as analytics, enrichment, email and backup providers.

Where do a CRM's AI features process data?

This is frequently documented separately from storage and is often a different provider in a different country. If the vendor's storage documentation does not cover the AI features, ask for the answer in writing.

Does a zero-retention agreement mean data never leaves?

No. Retention describes what happens after a request. The model still has to receive the input in order to produce the output, so the transmission occurs regardless of whether anything is kept.

Is regional hosting the same as data residency in Vietnam?

No. An account served from a nearby region is still served from outside Vietnam. Record them as separate answers.

What does Vietnamese law say about processing on an overseas platform?

Article 20(1)(c) of Law No. 91/2025/QH15 lists, among the cases of cross-border transfer of personal data, using a platform located outside the territory of Vietnam to process personal data collected in Vietnam. What that means for a particular company is a question for qualified Vietnamese counsel.