Security and compliance buyers evaluate CRM through HIPAA (healthcare, bookkeeping, legal), SOC 2 (SaaS vendor dependency), GDPR (EU customer data), CCPA (California customer data), and industry-specific lenses (bar rule, AICPA peer review, SBA oversight). Strkr documents each posture explicitly.
Security and compliance buyers evaluate CRM through specific regulatory lenses. The pain points below are what Strkr hears from compliance officers, CISOs, and compliance-sensitive buyers running a CRM evaluation.
Many vendors publish a trust center with the SOC 2 and HIPAA logos but no detail on the certification scope, the renewal date, or the audit controls. The compliance officer cannot ground the evaluation in actual evidence. Strkr publishes compliance posture explicitly with scope, renewal cadence, and audit evidence available under NDA.
Legacy CRM vendors commonly gate the HIPAA Business Associate Agreement to the enterprise tier at $200 per user per month. Mid-market healthcare SaaS and medical practice bookkeeping shops get locked out. Strkr issues the BAA on request without enterprise upgrade. HIPAA posture lands on Pro at $59 per user per month.
Vendors commonly withhold the SOC 2 report until the Master Service Agreement signs. The security team cannot evaluate the audit evidence before commitment. Strkr makes the SOC 2 Type I report (completed) and the Type II audit evidence (in progress) available under NDA during the evaluation call.
GDPR Data Processing Addendum (DPA) often ships as a separate negotiation with legal review timeline of 3 to 6 weeks. Strkr ships a standard DPA template available for pre-signature review during the evaluation call. The DPA signs with the main MSA, not as a separate round.
GDPR Article 28 requires sub-processor disclosure. Vendors often publish incomplete sub-processor lists or make the list hard to find. Strkr publishes the full sub-processor list in the trust center with each vendor, their function, and the data types they process. The list updates on quarterly cadence with 30-day customer notice on changes.
Compliance-sensitive buyers assume vendors carry industry-specific certifications (FedRAMP for federal, FINRA for broker-dealer, HITRUST for healthcare, PCI-DSS for payment handling). Strkr publishes the certifications held versus the certifications not held explicitly instead of letting the buyer assume coverage.
Strkr publishes compliance posture explicitly across HIPAA, SOC 2, GDPR, CCPA, and industry-specific regimes. The cards below describe each posture with the scope and renewal cadence.
HIPAA posture ships with the Business Associate Agreement (BAA) available on request without an enterprise upgrade. The AI call retrieval scope limits to non-PHI fields by default. The audit log captures every PHI-adjacent access with 7-year retention option on Scale tier. The BAA signs within 2 business days of request.
SOC 2 Type I audit completed in 2026 covering the Security Trust Service Criteria. Type II audit is in progress with a target completion of 2026-Q4 covering a 6-month observation period. The Type I report and the Type II evidence are available under NDA during the evaluation call.
GDPR posture ships with a standard Data Processing Addendum (DPA) template, published sub-processor list, Article 32 technical and organizational measures (encryption, access control, audit log), and EU data residency option in AWS Ireland. Data subject request workflow covers Articles 15 through 22.
CCPA posture ships with the required consumer rights workflow (right to know, right to delete, right to opt out of sale, right to non-discrimination). Strkr does not sell personal information. The privacy policy publishes the required disclosures. Verifiable consumer requests process within the 45-day statutory window.
Strkr does not hold FedRAMP certification (federal government), FINRA registration (broker-dealer), HITRUST certification (healthcare), PCI-DSS Level 1 attestation (payment card storage), or FISMA authorization (federal information). Buyers requiring these should flag during the evaluation call.
ISO 27001 certification is on the Strkr roadmap with a target of 2027 for alignment and audit. ISO 27001 overlaps substantially with SOC 2 Type II controls, so the Type II completion in 2026-Q4 drives most of the ISO preparation work.
For specific industry regimes Strkr publishes guidance: ABA Rule 1.6 for legal practice (bar-rule retention), AICPA peer review for accounting practice (document retention), SBA oversight review for SBA lending (loan file retention), state insurance regulation for insurance brokerage.
The security controls back the compliance posture across encryption, access control, audit logging, and incident response. The cards below describe each control.
All tenant data encrypts at rest through AWS KMS-managed keys with per-tenant key separation. Database rows, document uploads, and cached data all encrypt. Keys rotate on AWS default cadence. The KMS key policy restricts access to the Strkr platform service with no customer or employee access.
All traffic to Strkr runs TLS 1.2 and 1.3 with HSTS enforcement. API traffic, UI traffic, webhook outbound, and integration pulls all encrypt. The TLS configuration follows AWS modern cipher suite recommendations with weak ciphers disabled.
The role matrix supports record-level scoping across 54 resource types with field-level permissions on sensitive fields. The scoping respects at the API layer and the UI layer. The admin console tracks every permission change in the audit log.
The audit log captures record read, record write, email send, document access, and AI call events with user, timestamp, record ID, and access context. 90-day default retention tunable per tenant up to 7 years. SIEM export via webhook with HMAC signing.
The Strkr incident response process documents detection, triage, containment, remediation, and post-incident review. Customer notification lands within 72 hours of confirmed material incident with specific scope detail. The incident response plan is available under NDA during the evaluation call.
Strkr runs monthly automated vulnerability scanning across the application and infrastructure. External penetration testing runs quarterly through an independent firm. Findings close within SLA based on severity: Critical in 7 days, High in 30 days, Medium in 90 days, Low in 180 days.
The business continuity plan targets Recovery Time Objective (RTO) of 4 hours and Recovery Point Objective (RPO) of under 5 minutes. Backup posture runs on AWS RDS with point-in-time recovery (last 35 days) and daily snapshots (retained 90 days). Multi-AZ deployment covers single-AZ failure scenarios.
Strkr makes compliance evidence available during the evaluation call under NDA. The cards below describe what ships.
The SOC 2 Type I report covers the Security Trust Service Criteria design assessment. The report describes the control environment, the controls in place, and the auditor assessment. Available under NDA during the evaluation call.
For teams running their own SOC 2 Type II audit the Strkr Type II in-progress evidence (control operating effectiveness, management responses, auditor interim findings) ships under NDA. The evidence supports the vendor review section of the customer own audit.
The standard HIPAA BAA template ships for pre-signature review. The BAA covers the required HIPAA sections (permitted uses, safeguards, reporting, subcontractor, access, amendment, termination). Standard terms sign within 2 business days of request.
The standard GDPR Data Processing Addendum ships with the Standard Contractual Clauses (SCCs) for cross-border data transfer. The DPA includes the Article 28 processor obligations and the sub-processor list reference. Signs with the main MSA.
The latest quarterly penetration test summary (findings, severity, remediation status) ships under NDA. The summary covers the external attack surface, authentication flow, API surface, and web application vulnerabilities. Full test report available on request.
The sub-processor list publishes in the trust center with each vendor, function, data types processed, and jurisdiction. The list refreshes quarterly with 30-day customer notice on changes. Vendors on the list cover compute (AWS), identity (Clerk), AI inference (via Strkr AI capability), messaging (tier-one US carriers), and support.
Standard security questionnaires (SIG, CAIQ, VSAQ) ship pre-filled for review. The pre-filled responses cover the common questions on encryption, access control, audit, incident response, business continuity, and compliance. Teams can accept the pre-filled version or customize for their specific review.
The comparison below is Strkr compliance transparency versus the common pattern of CRM vendors with logo-only trust centers.
| Feature | Strkr | CRM with opaque compliance |
|---|---|---|
| Compliance posture detail | Explicit scope and renewal. | Logo only. |
| HIPAA BAA tier | On request, no tier upgrade. | Enterprise at $200 per user. |
| SOC 2 report availability | Under NDA pre-signature. | Post-MSA only. |
| GDPR DPA | Standard template ready. | Separate negotiation. |
| Sub-processor list | Full public with notice. | Incomplete or hidden. |
| Pen test summary | Quarterly, under NDA. | On request only. |
| Security questionnaire | SIG, CAIQ, VSAQ pre-filled. | Build from scratch. |
| Explicit about non-coverage | States what is not held. | Lets buyer assume. |
| Flat per-seat pricing | Starter $29, Pro $59, Scale $119. | Enterprise plus add-ons. |
The playbooks below are patterns Strkr onboarding sees across compliance-first CRM deployments.
A 32-rep healthcare SaaS team selling into medical practice buyers needed HIPAA compliance. The legacy CRM gated the BAA to the enterprise tier at $200 per user per month. Strkr onboarding issued the BAA on request within 2 business days and configured HIPAA posture on Pro tier at $59 per user per month. HIPAA compliance landed without the enterprise upgrade.
A 48-rep SaaS team sold into enterprise customers requiring SOC 2 Type II vendor evidence. The team needed CRM vendor SOC 2 posture that would stand up to customer audit review. Strkr shipped the SOC 2 Type I report and Type II in-progress evidence under NDA during customer audits. The customer audit response time dropped from 3 weeks to 3 days.
A 24-rep agency with EU customer base needed GDPR Data Processing Addendum before signing. Legacy vendors required 3 to 6 week DPA negotiation. Strkr onboarding shipped the standard DPA template with Standard Contractual Clauses for pre-signature review. The DPA signed with the MSA on day one. EU data residency landed in AWS Ireland.
An 85-rep enterprise software team ran a mandatory security vetting process for all vendors. The process required SIG and CAIQ completion plus pen test summary review. Strkr shipped pre-filled SIG and CAIQ questionnaires plus the latest quarterly pen test summary under NDA. Vendor onboarding dropped from 90 days to 21 days.
A 32-rep law firm needed bar-rule retention (specific state bar document retention periods) across client communication and matter work. The legacy CRM retained for 30 days. Strkr onboarding configured the audit log for the bar-rule retention ceiling (5 to 7 years depending on state) on the Scale tier. Bar-rule compliance landed inside the CRM.
Book a 30 minute call. We will walk through the compliance evidence, the security controls, and the regulatory posture for your industry.
HIPAA posture ships with the Business Associate Agreement (BAA) available on request without an enterprise tier gate. The standard BAA covers the required HIPAA sections (permitted uses, safeguards, reporting, subcontractor, access, amendment, termination). The BAA signs within 2 business days of request. The AI call retrieval scope limits to non-PHI fields by default with admin tuning per deal or per record type. The audit log captures every PHI-adjacent access with 7-year retention option on the Scale tier.
SOC 2 Type II audit is in progress with a target completion date of 2026-Q4 covering a 6-month observation period on the Security Trust Service Criteria. The Type I report (completed earlier in 2026) ships under NDA during evaluation calls. The Type II in-progress evidence (control operating effectiveness, management responses, auditor interim findings) ships under NDA for teams running their own Type II audit with Strkr as a vendor dependency. Full Type II report ships on completion in 2026-Q4.
GDPR posture ships with a standard Data Processing Addendum (DPA) template including Standard Contractual Clauses for cross-border data transfer, published sub-processor list in the trust center, Article 32 technical and organizational measures (AWS KMS encryption at rest, TLS 1.2 and 1.3 in transit, record-level access control, 90-day audit log), and EU data residency option in AWS Ireland. Data subject request workflow covers right to access, right to rectification, right to erasure, right to restriction, right to portability, right to object, and right to not be subject to automated decision-making.
Strkr does not hold FedRAMP certification (federal government), FINRA registration (broker-dealer), HITRUST certification (healthcare, overlapping but distinct from HIPAA), PCI-DSS Level 1 attestation (payment card storage), or FISMA authorization (federal information). ISO 27001 is on the roadmap for 2027. Teams requiring these specific certifications should flag during the evaluation call so Strkr can either confirm fit or flag the gap honestly. Strkr publishes the certifications held versus not held explicitly instead of letting the buyer assume coverage.
The Strkr incident response plan documents detection, triage, containment, remediation, and post-incident review. Customer notification lands within 72 hours of confirmed material incident with specific scope detail. The incident response plan is available under NDA during the evaluation call. The breach notification process satisfies GDPR Article 33 (72-hour supervisory authority notification) and the HIPAA Breach Notification Rule (60-day affected individual notification).
The sub-processor list publishes in the trust center with each vendor, their function, the data types they process, and their jurisdiction. Current sub-processors cover compute (AWS), identity (Clerk), AI inference (via Strkr AI capability), messaging (tier-one US carriers), and support. The list refreshes quarterly with 30-day customer notice on changes. Material changes to sub-processors (new sub-processor, scope change, jurisdiction change) trigger customer notification for review. Customers can object to specific sub-processor changes under the terms of the DPA.
No sales call, no migration consultant, no four-month implementation. Enter your card, get 14 days of the full Pro tier, cancel any time before day 14 with zero charge. Spin up a workspace, import your CSV, and have something useful before lunch.
