Enterprise procurement reviews run security, compliance, legal, finance, and data residency in parallel. Strkr ships the paperwork ready to go with SOC 2 Type II in progress, HIPAA BAA on request, SSO on Scale, and the full audit log that a procurement team expects. See the detailed compliance detail at /compliance.
Procurement reviews live at the intersection of security, legal, finance, and operations. The vendor has to answer 180 questions across five domains in a window of 11 to 42 business days. Half the vendors in the mid market CRM space fail the gate on compliance posture, data residency, or audit trail depth. The six pain points below are what Strkr onboarding hears from procurement teams running the evaluation.
Enterprise security questionnaires (SIG Lite, SIG Core, CAIQ, custom bank questionnaires) run 180 to 420 questions across network security, application security, data handling, incident response, identity management, and compliance posture. Strkr ships pre answered responses to the standard questionnaires at /compliance with the answers backed by the audit log and security documentation.
Procurement expects SOC 2 Type II as table stakes for a system of record. Strkr honest posture is SOC 2 Type II in progress with target 2026-Q4. The Type I report is available today. For procurement teams that need Type II before go live the Strkr team provides a letter of attestation from the auditor and a target date, which satisfies most enterprise procurement teams during a staged rollout.
GDPR and increasing non EU data sovereignty rules push data residency to the procurement checklist. Strkr runs on AWS with primary tenancy in us-east-1 (Virginia) with EU residency available for enterprise tier customers on request. For procurement teams with strict data residency the Strkr Scale tier can provision EU tenancy during onboarding.
The data processing agreement (DPA) and the subprocessor list review takes 4 to 6 weeks in a typical enterprise procurement cycle. Strkr publishes the DPA template, the subprocessor list, and the SCC (Standard Contractual Clauses) template at /compliance and the legal review runs in under a week for most procurement teams. The DPA covers GDPR, CCPA, and HIPAA where BAA applies.
Many procurement reviews ask about audit log depth. Record write audit is standard. Record read audit is less common and increasingly expected for regulated industries. Strkr audit log captures every record read, record write, email send, document access, and AI call with 90 day default retention tunable per tenant to the regulatory ceiling (typically 7 years).
Enterprise SSO (SAML and OIDC) is a procurement gate. Strkr delivers SAML and OIDC on Scale tier through Clerk, turned on per enterprise client with the enterprise IdP (Okta, Azure AD, Google Workspace, OneLogin, Ping, Duo, Auth0). MFA with TOTP and text based verification is live across all tiers. Verified Domains is live on Scale tier.
The six cards below are what the Strkr procurement team ships to the enterprise procurement reviewer on day one. The documents live at /compliance and update on a quarterly cadence.
SOC 2 Type I report is available today. Type II report target 2026-Q4. The report covers Security, Availability, Processing Integrity, Confidentiality, and Privacy trust service criteria. Letter of attestation from the auditor available on request for procurement teams.
Pre answered SIG Lite (Shared Assessments) and CAIQ (Cloud Security Alliance) responses with the full 180 to 420 question coverage. The answers are backed by the audit log, security documentation, and infrastructure configuration. Enterprise procurement teams typically clear the questionnaire in days instead of weeks.
DPA template covering GDPR Article 28 processor obligations, CCPA service provider obligations, and HIPAA Business Associate obligations where applicable. Standard Contractual Clauses (SCC) template for EU to non EU data transfer. Subprocessor list published and updated quarterly.
Information Security Management System (ISMS) documentation covering access control, network security, application security, data handling, incident response, business continuity, and vendor management. The ISMS maps to ISO 27001 controls (ISO 27001 certification target 2027).
HIPAA Business Associate Agreement (BAA) template available on request for customers that handle protected health information. The BAA covers the HIPAA Security Rule and Privacy Rule obligations with the breach notification protocol and the subprocessor flow down.
Incident response plan with escalation procedures, breach notification protocol with 72 hour notification commitment for GDPR applicable incidents, and the historical incident log. Zero reportable breaches to date. The IR plan is tested on a biannual cadence.
The seven cards below are the platform security posture details that procurement security reviewers ask about. Each is a working control that lands on day one.
Strkr runs on AWS with primary tenancy in us-east-1 (N. Virginia). The infrastructure uses AWS Lambda for API, AWS RDS Aurora Postgres for data, AWS S3 for files, AWS KMS for integration token storage, and AWS Secrets Manager for platform credentials. EU residency available for Scale tier customers on request.
All data encrypted at rest using AES-256 with AWS KMS managed keys. All data in transit encrypted using TLS 1.2 or higher. Backup data encrypted at rest. Integration tokens stored encrypted in AWS KMS with role based access to decryption. Platform credentials stored encrypted in AWS Secrets Manager with rotation policy.
SSO via SAML 2.0 and OIDC on Scale tier through Clerk. MFA with TOTP and text based verification live across all tiers. Verified Domains live on Scale tier. Role based access control with 54 resource type permissions. Session management with configurable session policy and IP allowlist.
Audit log captures every record read, record write, email send, document access, and AI call with timestamp, user, tenant, record ID, and action detail. 90 day default retention tunable per tenant to the regulatory ceiling. The audit log is exportable through API for SIEM integration (Splunk, Datadog, Sumo Logic).
Private VPC with network segmentation between application, data, and admin tiers. NAT gateway for outbound traffic. Web Application Firewall (AWS WAF) in front of the application layer. DDoS protection through AWS Shield. Private subnets for data layer with no direct internet access.
Quarterly penetration testing by third party assessor. Static application security testing (SAST) in the CI pipeline. Software composition analysis for third party library vulnerabilities. Dependency updates on a weekly cadence. Vulnerability disclosure program with 90 day coordinated disclosure window.
Automated daily backups retained for 30 days. Point in time recovery for 7 days. Backup data encrypted at rest. Cross region backup replication for Scale tier. Recovery Time Objective (RTO) of 4 hours. Recovery Point Objective (RPO) of 15 minutes. Business continuity plan tested biannually.
The six cards below walk through the enterprise procurement cycle with Strkr. The sequence has run cleanly for 42 enterprise procurement reviews across 2026.
Strkr delivers the full document pack on day one of the procurement review. SOC 2 Type I report, pre answered SIG Lite and CAIQ, DPA template, ISMS documentation, BAA template, IR plan. The procurement team starts the review with the paperwork in hand.
The procurement security team runs the deep dive on the questionnaire responses, the infrastructure documentation, and the incident response plan. Strkr security team is available for a 60 minute Q and A session to clarify any items. Follow up questions typically land in days instead of weeks.
The procurement legal team runs the DPA review and the master agreement redline. Strkr legal team is responsive on redlines and typically closes the legal review in 5 to 10 business days. SCC addendum for EU to non EU data transfer attaches as needed.
The procurement compliance team maps Strkr controls to the internal compliance framework (NIST CSF, ISO 27001, HITRUST where applicable). Strkr ships a mapping document that covers the common framework alignment. Gaps are documented and remediation timelines agreed.
The procurement finance team runs the vendor onboarding (W-9, insurance certificate, financial strength review). Strkr provides the standard vendor onboarding package. The master services agreement signs. The go live date is confirmed.
The customer identity team configures SSO (SAML or OIDC) with the enterprise IdP. Strkr Scale tier includes dedicated SSO configuration support. The pilot cohort goes live on business day 30 to 42. The full enterprise rollout follows the standard 18 business day Strkr onboarding playbook.
Most mid market CRMs gate the enterprise compliance posture to the Enterprise tier at $100 to $225 per seat. Strkr ships the posture on Scale at $119 per seat.
| Feature | Strkr | Typical mid market CRM |
|---|---|---|
| SOC 2 Type II posture | In progress target 2026-Q4, Type I today, letter of attestation available. | Usually Type II available on Enterprise tier. |
| Pre answered SIG Lite | Published at /compliance. | Response on request, typical turnaround 2 weeks. |
| HIPAA BAA | Available on request, no tier gate. | Enterprise tier typical gate. |
| SSO (SAML and OIDC) | Scale tier at $119 per seat. | Enterprise tier at $150 to $225 per seat. |
| Record read audit log | Yes with 90 day default tunable to 7 years. | Record write only typical. |
| Data residency EU | Available on Scale tier. | Enterprise tier typical gate. |
| DPA with SCC addendum | Published template. | Custom negotiation typical. |
| Subprocessor list | Published and updated quarterly. | On request. |
| Incident response commitment | 72 hour GDPR notification. | Varies. |
| Platform credential posture | AWS KMS and AWS Secrets Manager. | Varies. |
The playbooks below are patterns Strkr onboarding sees across enterprise procurement reviews in 2026.
A Fortune 500 financial services firm ran the Strkr procurement review for a private banking pilot. The security questionnaire ran 420 questions across SIG Core and the custom bank security questionnaire. Strkr pre answered responses closed the questionnaire in 11 business days. The DPA, BAA, and master agreement redline closed in another 14 business days. The pilot cohort went live on business day 42.
A regional health system ran the Strkr procurement review for a specialty practice CRM pilot. The HIPAA BAA was the central question. Strkr BAA template closed the review in 7 business days. The HITRUST mapping document closed the compliance mapping. SSO configured with Azure AD on day 24. Pilot live on day 32.
A German subsidiary of a US multinational ran the Strkr procurement review with EU data residency as the central requirement. Strkr Scale tier EU tenancy provisioned during onboarding. The DPA with SCC addendum closed the GDPR review. The pilot cohort went live 24 business days after review start.
A federal contractor ran the Strkr procurement review for a government services business unit. FedRAMP was the central question. Strkr honest posture is FedRAMP not yet in process. The contractor ran Strkr for the commercial business unit and used a separate FedRAMP authorized system for the government work. Strkr commercial pilot went live on business day 28.
A private equity backed carveout spun out from a Fortune 100 parent ran the Strkr procurement review for the newly independent entity. The parent compliance program was gone. Strkr pre answered questionnaires, DPA, BAA, and the ISMS documentation covered the full compliance program for the new entity. Pilot live on business day 24.
Book a 30 minute call with the Strkr procurement team. We will walk through the document pack, the compliance posture, the DPA template, and the pilot rollout plan. The full detail lives at /compliance.
The full Strkr compliance detail lives at /compliance on the marketing site. The page covers SOC 2 posture (Type I available, Type II target 2026-Q4), HIPAA posture (BAA on request), GDPR and CCPA compliance (today), ISO 27001 (target 2027), data residency (us-east-1 default, EU on Scale), encryption at rest and in transit, SSO (SAML and OIDC on Scale through Clerk), audit log, incident response, subprocessor list, and the full DPA template. The page updates quarterly as the compliance program advances.
Strkr ships pre answered SIG Lite (Shared Assessments) and CAIQ (Cloud Security Alliance) responses at /compliance covering the full 180 to 420 question coverage. The answers are backed by the audit log, security documentation, and infrastructure configuration. For custom bank questionnaires or industry specific questionnaires (HITRUST, FFIEC) the Strkr security team maps the responses from the standard pre answered base and typically delivers the full custom response in 7 to 14 business days.
SOC 2 Type I report is available today covering the Security, Availability, Processing Integrity, Confidentiality, and Privacy trust service criteria. SOC 2 Type II report is in progress with target 2026-Q4. For procurement teams that need Type II before go live Strkr provides a letter of attestation from the auditor and the target date, which satisfies most enterprise procurement teams during a staged rollout. Honest framing matters here. Strkr does not claim Type II until the report is delivered.
FedRAMP authorization is not yet in process at Strkr. For federal civilian agencies, Department of Defense customers, or federal contractors with CUI handling requirements Strkr is not the right fit today. For federal contractors with commercial business units outside the FedRAMP perimeter Strkr can serve the commercial side while the federal side runs on a FedRAMP authorized system. Honest posture matters here.
The DPA template includes the Standard Contractual Clauses (SCC) addendum for EU to non EU data transfer under GDPR Article 46. The SCC addendum covers the EU Commission approved modular SCC form adopted in June 2021 with the appropriate module (controller to processor, processor to controller, processor to processor) based on the data flow. For enterprise customers with EU data residency requirements Strkr Scale tier can provision EU tenancy to avoid cross border transfer entirely.
Strkr audit log captures every record read, record write, email send, document access, and AI call with timestamp, user, tenant, record ID, and action detail. 90 day default retention tunable per tenant to the regulatory ceiling (typically 7 years for financial services, 7 years for legal, 6 years for HIPAA). The audit log is exportable through API for SIEM integration (Splunk, Datadog, Sumo Logic). Most mid market CRMs capture record write only. Record read audit is less common and increasingly expected for regulated industries, which puts Strkr ahead of the typical mid market CRM audit posture.
No sales call, no migration consultant, no four-month implementation. Enter your card, get 14 days of the full Pro tier, cancel any time before day 14 with zero charge. Spin up a workspace, import your CSV, and have something useful before lunch.
