A secure CRM is not a tier. It is a posture across identity, data, audit, and compliance. Strkr ships SSO (SAML and OIDC via Clerk), MFA with TOTP and text verification, Verified Domains, encrypted storage via AWS KMS, 90-day audit log tunable per tenant, role-scoped data visibility, and HIPAA BAA on request.
A secure CRM evaluation runs through four surfaces: identity (SSO, MFA, user lifecycle), data (encryption at rest and in transit, role-scoped visibility), audit (record access logging, retention policy, SIEM export), and compliance (HIPAA, SOC 2, GDPR, CCPA, industry-specific). The pain points below are what Strkr hears from security-focused buyers evaluating the CRM.
Most CRM vendors gate SSO (SAML, OIDC) to the enterprise tier, forcing teams onto Enterprise plans at $150 to $300 per user per month just to turn on identity management. Strkr ships SSO (SAML and OIDC via Clerk) on Scale at $119 per user per month, keeping identity management accessible at mid-market scale.
Legacy CRMs enforce MFA inconsistently across user types (admin yes, standard user no), authentication methods (text only, no TOTP), or workflows (login yes, API no). Strkr ships MFA (TOTP plus text-based verification) across all tiers for all users. The admin can enforce MFA tenant-wide.
Most CRMs log record writes (create, update, delete) but not record reads. A security team cannot answer the question "who read this account record in the last 30 days" because the data does not exist. Strkr audit log captures both record read and record write with 90-day default retention tunable per tenant.
Mid-market CRMs often ship with permissive default role scoping (all users see all records in the tenant). The security team wants record-level scoping (sales rep sees only their records, manager sees only their team, admin sees all). Strkr role matrix supports record-level scoping across 54 resource types.
Teams running a shared CRM across contractors, agencies, or acquisition entities need domain verification to prevent impersonation. Verified Domains require users to prove ownership of the email domain they log in with. Strkr ships Verified Domains on Scale tier through Clerk.
Many vendors publish a one-page trust center with the SOC 2 logo but no detail on the certification scope, the renewal date, or the compliance posture. Strkr publishes compliance posture explicitly: HIPAA with BAA on request, SOC 2 Type II in progress with target 2026-Q4, GDPR and CCPA compliant today.
The identity surface runs on Clerk, which handles the SSO, MFA, and Verified Domains behind standard protocols. The cards below describe what identity management ships on Strkr.
SSO ships on Scale tier through Clerk with SAML 2.0 and OIDC protocols. The admin configures the identity provider (Okta, Azure AD, Google Workspace, OneLogin, Auth0) with standard metadata exchange. SSO lands in 30 to 90 minutes of admin configuration.
MFA (TOTP via Google Authenticator or Authy, plus text-based verification) ships across all tiers for all users. The admin can enforce MFA tenant-wide with grace period for user enrollment. API tokens require MFA on creation.
Verified Domains require users to prove ownership of the email domain they log in with through DNS TXT record verification. The feature ships on Scale tier through Clerk. Teams running cross-entity CRM access use Verified Domains to prevent impersonation attacks.
For teams on Scale with SSO Strkr supports SCIM 2.0 for user lifecycle management: just-in-time provisioning on first login, group-based role assignment, and deprovisioning on identity provider deactivation. The user lifecycle stays automated.
The admin can configure IP allowlist policy to restrict access to specific IP ranges (office network, VPN exit nodes). Attempted login from outside the allowlist denies with audit log entry. The feature ships on all tiers.
The admin configures session policy: session timeout (idle timeout, maximum session duration), concurrent session limit (one device, multiple devices), and trusted device management. Session policy ships on all tiers with tighter defaults on Scale.
Password policy supports minimum length, character complexity, password rotation requirement, and breach-password check (against the HaveIBeenPwned database). The admin tunes per tenant. Password policy ships on all tiers.
The data surface handles encryption at rest, encryption in transit, role-scoped data visibility, and data residency. The cards below describe each component.
All tenant data encrypts at rest through AWS KMS-managed keys with per-tenant key separation. Database rows, document uploads, and cached data all encrypt. The KMS key rotation policy runs on AWS default cadence.
All traffic to Strkr runs TLS 1.2 and 1.3 with HSTS enforcement. API traffic, UI traffic, webhook outbound, and integration pulls all encrypt. The TLS configuration follows AWS modern cipher suite recommendations.
The role matrix supports record-level scoping (sales rep sees own records, manager sees team records, admin sees all) across 54 resource types including Account, Contact, Deal, Opportunity, Activity, Custom Objects. The admin tunes per role or at the record level.
For sensitive fields (SSN, compensation data, strategic notes) the admin can hide specific fields from specific roles. The field hides at the API layer, not just the UI, so API access respects the same scoping.
Data residency defaults to US-East (AWS Virginia). For EU customers Strkr can provision in EU-West (AWS Ireland) on request with the tenant provisioning explicitly scoped to the region. Data residency choice persists for the tenant lifetime.
Database runs on AWS RDS with point-in-time recovery (last 35 days) and daily snapshots (retained 90 days). Disaster recovery RTO is 4 hours, RPO is under 5 minutes. The backup posture meets most enterprise security requirements.
Platform credentials (integration tokens, API keys for third-party services) store in AWS Secrets Manager. Per-user OAuth tokens store with AWS KMS encryption. Secrets never land in environment variables, config files, or source code.
The audit log captures the full access trail across record reads, record writes, email sends, document accesses, and AI calls. The cards below describe each log type and retention policy.
Every record read (viewing an account page, loading a deal detail, running a report that pulls records) logs with user, timestamp, record ID, and access context. The log answers the question "who read this account in the last 30 days".
Every record write (create, update, delete) logs with user, timestamp, record ID, field-level before and after values, and access source (UI, API, workflow). The log provides full accountability for data changes.
Every email sent through Strkr (direct rep send, cadence send, AI-drafted send) logs with user, recipient, timestamp, template reference, and content hash. The log supports attribution review and privacy response.
Every document access (upload, download, view, delete) logs with user, timestamp, document ID, and access context. The log tracks sensitive attachment handling for compliance review.
Every AI call (reply draft, call summary, next-step suggestion, forecast narrative) logs with user, timestamp, prompt reference, retrieval scope, and response hash. The log supports AI governance review.
Audit log retention defaults to 90 days with tenant-level tunability up to 7 years for compliance-tier retention (HIPAA, SBA lender oversight, legal practice bar rules). Longer retention adds storage cost on Scale tier.
The audit log exports to SIEM platforms (Splunk, Datadog, Sumo Logic, Elastic) through the webhook spec with HMAC signing. The security team runs correlation and alerting on the Strkr audit stream alongside the broader security stack.
The comparison below is Strkr security posture versus the common pattern of CRMs that gate security to enterprise tiers.
| Feature | Strkr | CRM with enterprise-only security |
|---|---|---|
| SSO tier gate | Scale at $119 per user per month. | Enterprise typical at $150 to $300. |
| MFA across all users | TOTP plus text, all tiers. | Admin only or paid add-on. |
| Record read logging | Default across all tiers. | Writes only typical. |
| Record-level role scoping | Across 54 resource types. | Account-level only. |
| Field-level permissions | API-respected scoping. | UI-only hiding. |
| Verified Domains | Scale tier via Clerk. | Enterprise or absent. |
| Audit log retention | 90 days default, 7-year option. | 30 days typical. |
| SIEM export | Webhook spec with HMAC. | Enterprise add-on. |
| Compliance transparency | Explicit posture published. | Trust center logo only. |
The playbooks below are patterns Strkr onboarding sees across security-first CRM deployments.
A 48-rep SaaS team ran Salesforce Enterprise at $165 per user for SSO access. Strkr onboarding ran an 18-business-day migration with Okta SAML SSO configured through Clerk on Scale tier at $119 per user. Per-user savings of $46 funded the AI add-on and left $38 per user per month in cost reduction.
A 24-rep healthcare SaaS team needed a HIPAA-compliant CRM for marketing to medical practice buyers. Legacy vendors gated the BAA to enterprise tiers at $200 per user per month. Strkr onboarding configured the BAA on Pro tier at $59 per user per month. HIPAA posture landed without the enterprise upgrade.
A 32-rep financial services firm needed record-level role scoping across advisor books of business. The legacy CRM had account-level scoping with manual exceptions. Strkr onboarding configured the full role matrix with record-level scoping across the deal, account, and contact objects. Advisor-to-advisor record visibility leaks dropped to zero.
A 60-rep enterprise software team needed SIEM integration with Splunk for the SOC 2 Type II audit. Strkr onboarding configured the audit log webhook export to Splunk with HMAC signing. The SOC 2 auditor consumed the Strkr audit stream alongside the broader security logs. SOC 2 audit prep time dropped from 12 weeks to 4 weeks.
An 85-rep enterprise software team ran shared CRM access across acquisition entities and contractors. Impersonation risk was high because any email could log in. Strkr onboarding configured Verified Domains on Scale tier through Clerk. The impersonation surface closed. The admin team got the control they needed without blocking legitimate access.
Book a 30 minute call. We will walk through the identity surface, data surface, audit surface, and compliance posture with your security team.
Strkr security posture covers four surfaces. Identity: SSO (SAML and OIDC via Clerk) on Scale tier, MFA (TOTP plus text verification) across all tiers, Verified Domains on Scale tier, IP allowlist and session policy across all tiers. Data: AWS KMS-managed encryption at rest, TLS 1.2 and 1.3 in transit, record-level role scoping across 54 resource types, field-level permissions, data residency in US-East default with EU-West on request. Audit: record read and record write logging, email send logging, document access logging, AI call logging, 90-day default retention tunable per tenant up to 7 years, SIEM export via webhook. Compliance: HIPAA BAA on request, SOC 2 Type II in progress 2026-Q4, GDPR and CCPA compliant today.
For teams that need a HIPAA Business Associate Agreement (BAA) Strkr issues the BAA on request without an enterprise upgrade. The BAA covers the processing of Protected Health Information (PHI) in the Strkr tenant. The AI call retrieval scope limits to non-PHI fields by default, with admin tuning per deal or per record type. The BAA signs within 2 business days of request. HIPAA posture lands on the Pro tier at $59 per user per month.
SOC 2 Type II is in progress with a target completion date of 2026-Q4. The Type II audit covers the full observation period required for the attestation. Strkr publishes the quarterly audit status updates in the trust center. Teams running a SOC 2 Type II dependency can review the Strkr Type I report (completed earlier in 2026) and the ongoing Type II audit evidence under NDA during the evaluation call.
The Strkr audit log exports to SIEM platforms (Splunk, Datadog, Sumo Logic, Elastic) through the webhook spec with HMAC signing. The security team configures the webhook destination in the Strkr admin console with the HMAC signing key. The audit log streams in near-real-time to the SIEM for correlation, alerting, and compliance reporting. The export covers record read, record write, email send, document access, and AI call events.
Strkr role matrix supports record-level scoping across 54 resource types. The admin configures per-role scoping (sales rep sees own records, manager sees team records, admin sees all) or per-record scoping (specific record shared with specific users). Field-level permissions let the admin hide specific fields (SSN, compensation data, strategic notes) from specific roles. The scoping respects at the API layer, not just the UI, so programmatic access matches UI access.
SSO ships on Scale tier at $119 per user per month through Clerk with SAML 2.0 and OIDC protocols. The admin configures the identity provider (Okta, Azure AD, Google Workspace, OneLogin, Auth0) with standard metadata exchange: tenant metadata URL, SAML assertion configuration, OIDC client ID and secret. SSO configuration lands in 30 to 90 minutes with the admin on both sides working through the metadata exchange. SCIM 2.0 provisioning ships for teams on SSO with just-in-time provisioning, group-based role assignment, and deprovisioning on identity provider deactivation.
No sales call, no migration consultant, no four-month implementation. Enter your card, get 14 days of the full Pro tier, cancel any time before day 14 with zero charge. Spin up a workspace, import your CSV, and have something useful before lunch.
