A security architect evaluates a CRM through threat model, control effectiveness, evidence quality, and integration points. Strkr publishes the threat model, documents the controls, ships audit evidence under NDA, and designs the integration surface for security-conscious deployment.
A security architect at a 500-employee company evaluating a CRM vendor runs through threat model (who attacks, what, how), controls (identity, data, audit, incident response), evidence (logs, test reports, documentation), and integration points (SSO, API, SIEM). The pain points below are what Strkr hears from security architects during vendor evaluation.
Most CRM vendors do not publish a threat model. The security architect has to reverse-engineer the threat posture from the product documentation. Strkr publishes a documented threat model covering adversary types (external attacker, insider, compromised integration, supply chain), attack surfaces, and specific control mitigations.
The SOC 2 Type II attestation covers controls but does not detail which controls, how they operate, or how they tested. The security architect needs the operating-effectiveness evidence to evaluate posture. Strkr ships the Type I control detail and the Type II in-progress operating evidence under NDA during evaluation.
CRM vendors shipping AI capability often do not document the AI threat surface: retrieval scope, data egress boundaries, model training exposure, prompt injection mitigation. The security architect cannot evaluate AI governance posture. Strkr publishes the AI threat model, retrieval scope defaults, data egress boundaries, and the mitigations.
Vendors commonly run annual low-rigor penetration tests on the external attack surface only. The security architect needs quarterly rigor including application layer, API, and authentication flow. Strkr runs quarterly external pen tests covering the full attack surface with findings closed to SLA by severity.
The vendor sub-processor chain is often undisclosed or incomplete. The security architect cannot evaluate supply chain risk. Strkr publishes the full sub-processor list in the trust center with each vendor, function, data types, and jurisdiction. Changes trigger 30-day customer notice.
Vendor audit log integration often ships as CSV export only. The security architect cannot stream to the SIEM for correlation and alerting. Strkr ships audit log webhook export to Splunk, Datadog, Sumo Logic, and Elastic with HMAC signing. The audit stream feeds the broader security correlation layer.
Strkr publishes a documented threat model covering the adversaries, attack surfaces, and control mitigations. The cards below describe the threat model structure.
External attackers target credential stuffing (reused passwords from breaches), account takeover via phishing or SIM swap, and brute force. Mitigations: MFA across all tiers, Verified Domains on Scale, IP allowlist, rate limiting on authentication endpoints, breached-password check against HaveIBeenPwned, session anomaly detection.
Insider threats target data exfiltration by legitimate users, privilege escalation, or account compromise. Mitigations: role-scoped visibility across 54 resource types, field-level permissions on sensitive fields, record read logging in audit, anomaly detection on unusual access patterns, mandatory MFA.
Compromised integrations target the token store, the integration code path, or the upstream vendor. Mitigations: AWS KMS-encrypted token storage, HMAC-signed webhook verification, scope-restricted OAuth tokens, integration audit logging, 30-day sub-processor change notice.
Prompt injection targets the AI retrieval surface with malicious inputs that attempt to exfiltrate data outside the retrieval scope. Mitigations: strict retrieval scope defaults (deal and account scoped), output content filtering, prompt sanitization, no training on tenant data, AI call audit logging.
Data exfiltration via legitimate export surfaces (CSV download, API bulk pull, report scheduled delivery). Mitigations: API rate limiting (100 requests per second per tenant default), bulk export audit logging, download size anomaly detection, role-scoped export permissions.
Lateral movement from compromised standard user account to admin privilege. Mitigations: separate admin role with distinct auth requirements, admin action audit logging, admin session anomaly detection, deny-by-default on sensitive operations.
DoS targeting the API surface or UI. Mitigations: AWS Shield Standard across the perimeter, API rate limiting with per-tenant quotas, CDN caching for static assets, multi-AZ deployment for availability, documented RTO of 4 hours and RPO under 5 minutes.
The control architecture backs the threat model with specific controls across identity, data, audit, and AI governance. The cards below describe each control group.
Identity runs on Clerk with SAML 2.0 and OIDC SSO (Scale tier), MFA across all tiers (TOTP plus text), Verified Domains (Scale), SCIM 2.0 user lifecycle for teams on SSO, IP allowlist, session policy with configurable timeout, and password policy with breach check.
AWS KMS encryption at rest with per-tenant key separation, TLS 1.2 and 1.3 in transit with HSTS, record-level role scoping across 54 resource types, field-level permissions on sensitive fields, data residency options (US-East default, EU-West on request), credential storage in AWS Secrets Manager.
Audit log captures record read, record write, email send, document access, and AI call events with user, timestamp, record ID, and context. 90-day default retention tunable up to 7 years. SIEM webhook export with HMAC signing to Splunk, Datadog, Sumo Logic, Elastic.
AI calls run with strict retrieval scope (deal and account scoped by default), no training on tenant data, output content filtering for prompt injection mitigation, prompt sanitization on input, documented data egress boundaries, AI call audit logging with retention.
Admin changes to schema, workflow, roles, and integrations track in the audit log with before and after snapshot. Workflow changes ship as append-only versioned with diff visibility and one-click rollback. Breaking changes require admin confirmation.
The incident response plan documents detection, triage, containment, remediation, and post-incident review. Customer notification lands within 72 hours of confirmed material incident. The plan is available under NDA during evaluation. The plan tests through tabletop exercises on quarterly cadence.
Monthly automated vulnerability scanning across application and infrastructure. Quarterly external penetration testing through an independent firm. SLA by severity: Critical in 7 days, High in 30 days, Medium in 90 days, Low in 180 days. Pen test summary ships under NDA.
For the security architect evaluation Strkr ships a dedicated evidence package. The cards below describe what ships during the evaluation call.
The threat model document covers the adversary types, attack surfaces, and control mitigations. The document ships under NDA during the evaluation call. The security architect uses the document to validate the Strkr threat posture against the customer threat posture.
The SOC 2 Type I report covers the Security Trust Service Criteria design assessment with the controls, control objectives, and auditor assessment. Available under NDA. Supports the vendor review section of the customer own Type II audit.
For teams running their own Type II audit the in-progress operating-effectiveness evidence ships under NDA. The evidence covers the control tests, management responses, and auditor interim findings. Full Type II report lands 2026-Q4.
The latest quarterly external penetration test summary ships under NDA. The summary covers the external attack surface, authentication flow, API surface, and web application vulnerabilities. Findings with severity classification and remediation status. Full test report available on request.
The incident response plan ships under NDA with the documented detection, triage, containment, remediation, and post-incident review process. Latest quarterly tabletop exercise results included to show the plan is operational, not just documented.
Standard security questionnaires ship pre-filled for review: Shared Assessments SIG Core and SIG Lite, Cloud Security Alliance CAIQ, Vendor Security Alliance VSAQ. The pre-filled responses cover the common question categories. The security architect can accept the pre-filled version or customize for their specific review.
The architecture diagram ships under NDA showing the system boundary, data flow, trust boundaries, and third-party integration points. The diagram supports the security architect threat model review and the audit evidence validation.
The comparison below is Strkr security posture versus the common pattern of CRM vendors shipping security as trust-center logos.
| Feature | Strkr | CRM with security as marketing |
|---|---|---|
| Published threat model | Documented adversaries and mitigations. | None. |
| SOC 2 report pre-signature | Type I and Type II evidence under NDA. | Post-MSA only. |
| AI governance posture | Retrieval scope, egress, training documented. | Not documented. |
| Pen test cadence | Quarterly external, full surface. | Annual external typical. |
| SIEM audit integration | Webhook stream to major platforms. | CSV export only. |
| Pre-filled questionnaires | SIG, CAIQ, VSAQ ready. | Build from scratch. |
| Architecture diagram | Under NDA during evaluation. | On request only. |
| Sub-processor transparency | Full list with 30-day change notice. | Incomplete or hidden. |
| Flat per-seat pricing | Starter $29, Pro $59, Scale $119. | Enterprise plus add-ons. |
The playbooks below are patterns Strkr onboarding sees across security architect evaluations.
A 48-rep SaaS team ran a mandatory vendor security review including SIG completion, SOC 2 report review, and pen test summary. Legacy CRM vendors required 90-day evaluation. Strkr shipped pre-filled SIG, SOC 2 Type I report under NDA, and the latest quarterly pen test summary. Evaluation closed in 21 days. Procurement signed with full security sign-off.
An 85-rep enterprise software team required CISO-level sign-off on CRM vendor. The CISO wanted documented threat model, control architecture, and AI governance detail. Strkr shipped the threat model document, control architecture diagram, and AI governance posture under NDA. The CISO sign-off landed in two review cycles.
A 32-rep financial services firm needed Strkr audit log streaming to the firm Splunk instance for correlation with the broader security logs. Strkr onboarding configured the webhook export with HMAC signing to the Splunk HTTP Event Collector. The audit stream landed within 1 business day. SOC 2 audit prep time dropped by 60 percent.
A 60-rep agency security architect wanted detailed AI governance posture review: retrieval scope defaults, prompt injection mitigation, model training exposure, data egress boundaries. Strkr shipped the AI governance posture document and ran a 90-minute deep dive call with the Strkr platform team. AI governance signed off.
A 120-rep enterprise software team ran a third-party risk assessment through their TPRM program. The assessment required documented control effectiveness evidence. Strkr shipped the SOC 2 Type I report, Type II in-progress evidence, pen test summary, and architecture diagram under NDA. The TPRM assessment closed with low-risk classification.
Book a 30 minute call. We will walk through the threat model, control architecture, audit surface, and evidence package.
Yes. The Strkr threat model document ships under NDA during the evaluation call. The document covers the adversary types (external attacker, insider, compromised integration, prompt injection, data exfiltration, lateral movement, denial of service), the attack surfaces (authentication, API, UI, AI retrieval, integration tokens, document storage), and the control mitigations for each. The threat model refreshes on quarterly cadence as the product and threat landscape evolve.
The AI governance posture document covers retrieval scope defaults (deal and account scoped, cross-record disabled by default), data egress boundaries (AI inference happens through the Strkr AI capability without customer data landing in third-party training), prompt sanitization on input, output content filtering for prompt injection mitigation, AI call audit logging with retention, and the controls that prevent AI exfiltration or prompt injection abuse. Document ships under NDA.
The Strkr audit log exports to SIEM platforms through the webhook spec with HMAC signing. For Splunk the destination is the HTTP Event Collector endpoint. For Datadog the destination is the log ingestion endpoint. For Sumo Logic and Elastic the destinations use the standard webhook pattern. The security architect configures the webhook destination in the Strkr admin console with the HMAC signing key. The audit log streams in near-real-time to the SIEM for correlation and alerting.
External penetration testing runs quarterly through an independent firm covering the external attack surface (public API endpoints, authentication flow, web application UI), the authenticated API surface (role-scoped access, bulk export, integration surface), and the AI retrieval surface (prompt injection, scope boundary enforcement). Findings close within SLA by severity: Critical in 7 days, High in 30 days, Medium in 90 days, Low in 180 days. Latest quarterly summary ships under NDA during evaluation.
The sub-processor list publishes in the trust center with current entries covering compute (AWS), identity (Clerk), AI inference (via Strkr AI capability), messaging (tier-one US carriers), and support. Each entry lists the vendor name, function, data types processed, and jurisdiction. Material changes to sub-processors trigger 30-day customer notice via email and trust center update. Customers can object to specific sub-processor changes under the DPA terms. The list refreshes quarterly as the sub-processor landscape evolves.
The common pre-contract security architect requests are: SOC 2 Type I or Type II report, pre-filled SIG and CAIQ, latest quarterly penetration test summary, architecture diagram showing data flow and trust boundaries, incident response plan, sub-processor list, documented threat model, and AI governance posture document. Strkr ships all of these under NDA during the evaluation call. The evaluation closes in 21 to 45 days for most mid-market deployments.
No sales call, no migration consultant, no four-month implementation. Enter your card, get 14 days of the full Pro tier, cancel any time before day 14 with zero charge. Spin up a workspace, import your CSV, and have something useful before lunch.
