The answers your security team already drafted the questions for.

The California Consumer Privacy Act gives California residents the right to know what personal information a business has collected about them, the right to delete it, and the right to opt out of its sale. Strkr honors all three in practice because the product does not create a conflict with any of them.

Right-to-know requests are acknowledged within ten business days and resolved within forty-five. Workspace owners run the data-export tool, which produces a structured archive of every record associated with the data subject, and deliver the archive to the requester through the channel the data subject specified. The flow is the same whether the request comes from a resident of California, Colorado, Virginia, Connecticut, or any other state with a recent privacy law.

The right to opt out of sale is a non-issue on Strkr because Strkr does not sell data. There is no advertising business model. There is no data licensing side revenue. There is no aggregated product insights deal with a third party. The business model is subscription software, and that is the entire business model.

SOC 2 Type II is an attestation that a service organization has operated the controls it claims to operate, over a period of time, verified by an independent auditor. The Type II report is the one that enterprise security teams actually read, because it covers a window of months rather than a point in time.

Strkr is currently in the SOC 2 Type II audit window. The pre-audit controls are in place. The external auditor is engaged. The observation period runs through the fourth quarter of 2026, and the final report is expected to close in that quarter. We do not describe the audit as complete until the attestation letter is in hand, because an audit that is in progress is not the same thing as an audit that passed.

Prospects evaluating Strkr during the audit window can receive a letter of attestation from the auditor describing the stage of the engagement, under NDA. Once the Type II report closes, the report is available to customers and qualified prospects on request, also under NDA. We are deliberate about the status language because the industry has a tolerance for ambiguity on this topic that we do not share.

A subprocessor is a third party that processes customer data on behalf of a service provider. Honest disclosure of the subprocessor list is a GDPR requirement and a procurement question that most SaaS vendors answer vaguely. Strkr publishes the full list, with the purpose of each engagement and the type of data each one touches.

The list is kept current. Workspaces can subscribe to subprocessor change notifications, which are sent thirty days before a new subprocessor is onboarded, with the opportunity to object before the change takes effect. The notification is a product feature, not a policy document that lives on a page nobody reads.

Strkr maintains a documented incident response plan. The plan defines severity levels, the on-call rotation, the communication channels during an active incident, and the obligations to customers and regulators after one. The document exists, has been exercised, and is the input to the postmortems that follow every production incident.

Breach notification follows GDPR Article 33. In the event of a personal data breach, Strkr will notify affected customers without undue delay and within seventy-two hours of becoming aware of the breach, through the primary contact on the workspace account and through a secondary channel if the primary contact is the account that was affected. Customers in jurisdictions with stricter requirements receive notification on the earliest applicable schedule.

Postmortems are written for every production incident that crosses a severity threshold. The postmortem covers the root cause, the detection timeline, the user impact, and the follow-up work. For incidents that affected customer data, the postmortem is shared with the affected customers directly. The team's goal is to make incidents rare, and to make the ones that happen a learning event rather than a recurrence.

Enterprise security questionnaires (SIG, CAIQ, VSA) are a solved problem on Strkr. Pre-filled responses to the standard frameworks are available to prospects under NDA, which cuts the typical two-week turnaround to a one-day review by your security team. The responses are maintained by the people who built the controls, not by a marketing team that paraphrases the engineering documentation.

Custom questionnaires are answered inside two business days for workspaces on the Scale tier. The responses are signed by a named engineer who can be looped into a follow-up call if your security team wants to validate anything. The point is to get out of your procurement team's way, not to pad the timeline with a vendor-review cycle.

For procurement teams that prefer a vendor-trust portal, Strkr maintains a shared folder of the current attestations, policies, and architecture documentation, access-granted on request. The folder is updated when the documents are updated, not on a quarterly cadence that ships stale evidence.