Built for teams facing SOC 2 security reviews

The CRM that passes the security review without a tier upgrade for the base controls.

Enterprise security reviews ask for SOC 2 attestation, SSO, MFA, audit log retention, encryption at rest and in transit, and the full compliance package. Strkr ships the base compliance controls across all tiers with SOC 2 Type II in progress and SSO available on Scale.

Start free trial See pricing

What this audience is actually dealing with

The pains that bring buyers here.

A general CRM sales deal involving an enterprise prospect runs through the security review process. The security team sends a 180-item SIG Lite or VSAQ questionnaire asking for SOC 2 attestation, SSO, MFA, encryption, audit log retention, and the full compliance package. The pain points below are what Strkr onboarding hears on every call with sales teams fighting through security reviews quarterly for enterprise deals.

The security review stall

The deal pauses for 11 weeks on compliance.

Enterprise security reviews run 6 to 14 weeks on average. The deal pauses while the security team walks the compliance package. Teams on CRMs without the right posture lose deals or lose the review. Strkr compliance package covers the standard SIG Lite questionnaire, VSAQ, and CAIQ out of the box so the security team moves through the review in 2 to 4 weeks instead of 11.

SSO behind the Enterprise tier

Many CRMs gate SSO at $150 to $300 per seat.

HubSpot, Salesforce, and many CRMs gate single sign-on behind the Enterprise tier at $150 to $300 per seat per month. The customer facing the security review has to either upgrade (expensive) or fail the SSO requirement (lost deal). Strkr SSO ships on Scale at $119 per seat per month through Clerk with SAML and OIDC support.

Audit log depth

Partial write-only logs do not pass audit.

Compliance audits (SOC 2 Type II, HIPAA, ISO 27001, PCI DSS) ask for record read, record write, configuration change, and user permission change events with retention. Partial write-only logs do not pass. Strkr audit log captures the full event spectrum with 90-day default retention tunable per tenant up to seven years.

Data residency ambiguity

Where exactly does our data live.

Enterprise security teams ask about data residency, encryption key management, and sub-processor list. A CRM that cannot clearly answer the data residency and sub-processor questions fails the review. Strkr documents data residency (US primary, EU option in roadmap), encryption key management (AWS KMS), and the sub-processor list in the compliance package.

Vendor security assessment

The questionnaire takes a week to fill.

Vendor security assessments (SIG Lite, VSAQ, CAIQ, custom questionnaires) take 20 to 40 hours per response. Strkr ships a published answer document covering the common frameworks that cuts the response time to 2 to 4 hours by providing the pre-approved answers.

Pen test and vulnerability program

The security team wants proof of program.

Security reviews ask for recent penetration test results, vulnerability scanning cadence, and incident response program evidence. Strkr publishes the quarterly external pen test attestation, the vulnerability scanning cadence, and the incident response program documentation as part of the compliance package.

The compliance package

What ships with Strkr for a security review.

The compliance package covers the common frameworks, controls, and documentation that enterprise security reviews ask for. The security team gets a published package rather than a bespoke extract.

SOC 2 Type II

In progress with 2026-Q4 target.

SOC 2 Type II attestation is in progress with a 2026-Q4 target through a Big-4 auditor. The scope covers security, availability, and confidentiality trust service criteria. The current report delivers Type I attestation plus the Type II progress letter. Target 2026-Q4 for Type II completion.

HIPAA with BAA

Available on request on business plan.

HIPAA posture with Business Associate Agreement available on request on the business plan (which is below the enterprise tier most CRMs gate HIPAA behind). The BAA covers the standard HIPAA requirements with the audit log preserving every PHI access.

GDPR and CCPA

Compliant today with DPO contact.

GDPR compliance posture covers data subject rights, DPIA templates, cross-border transfer SCCs, DPO contact, and the published sub-processor list. CCPA compliance posture covers the California consumer privacy requirements. Both frameworks have published documentation in the compliance package.

SSO (SAML and OIDC)

Scale tier through Clerk.

Single sign-on through Clerk with SAML and OIDC protocols on the Scale tier at $119 per seat per month. Supported identity providers include Entra ID (Azure AD), Okta, Google Workspace, OneLogin, Ping Identity, and the standard SAML and OIDC compliant IdPs. SCIM provisioning supported.

MFA with TOTP

Live across all tiers.

Multi-factor authentication with TOTP (authenticator app) and text-based verification live across all tiers. The admin can enforce MFA at the workspace level. Per-user MFA settings capture through the audit log for the compliance posture review.

Verified Domains

Scale tier email domain verification.

Verified Domains on the Scale tier allow the tenant admin to enforce sign-in with the verified corporate domain. Prevents rogue account creation from personal email addresses. Standard enterprise security control.

Audit log

Record read and write with retention.

Encryption and key management

AWS KMS with tenant separation.

Data at rest encrypts with AWS KMS. Data in transit encrypts with TLS 1.2 or higher. Integration tokens live in AWS KMS. Platform credentials live in AWS Secrets Manager. Multi-tenant separation enforces at the application layer with row-level security.

The security review process

How a security review runs with Strkr.

An enterprise security review runs through a defined process. The cards below show the typical steps with the Strkr compliance package handling each.

Questionnaire delivery

SIG Lite, VSAQ, CAIQ answered in 2 to 4 hours.

The security team sends the SIG Lite questionnaire (300 items), VSAQ (240 items), or CAIQ (240 items). Strkr published answer document covers the standard frameworks. Response time compresses from 20 to 40 hours to 2 to 4 hours because the answers are pre-approved.

Pen test review

Current external pen test attestation.

The security team requests current penetration test results. Strkr publishes the quarterly external pen test attestation with the executive summary (findings count by severity, remediation status, next pen test date). The detailed report delivers under NDA.

SSO configuration

SAML or OIDC with Entra ID or Okta.

The security team configures SSO with the enterprise identity provider (Entra ID, Okta, Ping, OneLogin). Strkr admin configures the tenant SSO settings. The configuration completes in 2 to 4 hours. SCIM provisioning configures where the IdP supports it.

MFA enforcement

Workspace-level enforcement.

The admin enforces MFA at the workspace level requiring TOTP or text-based verification on every sign-in. The policy applies to all users. The compliance posture review captures the enforcement setting through the audit log.

Audit log scope

Retention set to compliance ceiling.

The admin configures the audit log retention to the compliance ceiling (90 days default, tunable to 7 years for compliance). The audit log exports to SIEM through the webhook spec or published API. The security team reviews the log structure during the review.

Sub-processor review

Published list with contact detail.

The security team reviews the Strkr sub-processor list (AWS, Clerk for identity, Stripe for billing, tier-one US carriers for SMS, Microsoft Azure for Entra ID integration). Each sub-processor carries contact detail, data processed, and the sub-processor agreement reference.

Strkr AI compliance posture

How Strkr AI fits a SOC 2 shop.

Strkr AI handles compliance concerns about generative AI with specific scope, no vendor training, and audit log capture. The security review team walks through the AI posture as part of the review.

Scope-limited retrieval

Workspace scoped by default.

Strkr AI retrieval scope limits to the user workspace by default. Cross-workspace retrieval does not happen. For teams with vertical workspaces (healthcare, finance, legal) the scope can tighten further to specific business units.

No vendor training

Tenant data not used to train models.

Tenant data flowing through Strkr AI does not train the underlying models. The vendor commitment carries into the data processing agreement.

Audit log capture

Every AI call captures.

The audit log captures every AI call with timestamp, user, scope, and prompt category. The compliance team reviews AI call patterns during audit. For regulated industries the AI call frequency and scope can report to the security team through the standard dashboard.

Model governance

Strkr owns the model routing.

Strkr handles model routing internally. The user never picks a model, which means the user cannot accidentally route to a model with inappropriate scope. The model routing policy encapsulates vendor decisions with the compliance posture consistent across the user base.

Human-in-loop by default

AI drafts, users send.

Strkr AI drafts outbound communication. The user reviews and sends. The pattern prevents AI from autonomously sending content without review, which satisfies the human-in-loop requirement most enterprise security reviews ask for in the AI section of the questionnaire.

AI feature opt-out

Admin can disable AI per tenant.

The admin can disable AI features at the workspace level for tenants that have not approved AI in their internal policy. The disable propagates immediately. The audit log captures the disable event for the compliance posture review.

Head-to-head

Strkr vs other CRMs for SOC 2 compliance posture.

The comparison below is Strkr compliance posture versus the common CRM alternatives at the point of enterprise security review.

Feature	Strkr	Typical CRM at security review
SOC 2 Type II	In progress with 2026-Q4 target.	Varies by vendor.
HIPAA BAA tier	Business plan.	Enterprise tier typical.
SSO tier	Scale at $119 per seat.	Enterprise at $150 to $300.
MFA included	All tiers.	All tiers typical.
Audit log retention	90 days default, up to 7 years.	30 to 90 days typical.
Verified Domains	Scale tier.	Enterprise tier typical.
Pen test cadence	Quarterly external attestation.	Annual typical.
Published compliance package	SIG Lite, VSAQ, CAIQ answered.	Custom response required.

How teams use Strkr

Three security review playbooks.

Pattern A

The Series B SaaS fighting Fortune 500 security reviews.

A Series B B2B SaaS team ran into enterprise security reviews on every deal above $150,000 ARR. Each review took 11 weeks and cost the deal roughly 2 to 3 months of velocity. Strkr onboarding ran a 24-business-day migration from HubSpot with the compliance package, SSO configuration, and audit log retention set to compliance ceiling as day-one deliverables. Average security review cycle time dropped from 11 weeks to 3 weeks. Deal velocity improved on enterprise closes.

Pattern B

The 85-person mid-market company passing HITRUST.

A mid-market company serving regulated healthcare clients needed HITRUST certification. The CRM had to carry the compliance posture through the HITRUST audit. Strkr onboarding ran a 32-business-day migration with the HIPAA BAA signed, the audit log retention set to the HITRUST ceiling, and the sub-processor list reviewed. HITRUST audit passed in the first attempt because the CRM compliance posture was clean.

Pattern C

The 180-person enterprise SaaS replacing Salesforce for the security team.

An enterprise SaaS replacing Salesforce had an internal security team that reviewed every tool. The team rejected several CRM alternatives because of SSO tier gating and audit log retention gaps. Strkr onboarding ran a 48-business-day migration with the full compliance package reviewed by the security team upfront. The approval cleared in 4 weeks instead of the typical 11 weeks because the compliance posture answered the security questionnaire without further research.

Pass the security review on a CRM shaped for the compliance posture.

Book a 30 minute call. We will walk through the compliance package, the SSO configuration, and the audit log retention with your security review requirements.

Start free trial See pricing

Common questions

What buyers in this bucket ask most.

What is the current SOC 2 attestation status?

Strkr SOC 2 Type II is in progress with a 2026-Q4 target through a Big-4 auditor. The current report delivers Type I attestation (point-in-time) plus the Type II progress letter indicating controls are operating effectively. The scope covers security, availability, and confidentiality trust service criteria. Common criteria review covers governance, risk assessment, control activities, monitoring, communication, and information systems. The published report delivers under NDA to prospects in the security review process.

What tier is required for SSO and does Strkr support Entra ID and Okta?

SSO ships on the Scale tier at $119 per seat per month through Clerk with SAML and OIDC protocols. Supported identity providers include Entra ID (Azure AD), Okta, Google Workspace, OneLogin, Ping Identity, Auth0, and the standard SAML and OIDC compliant IdPs. SCIM provisioning supported where the IdP offers it. Entra ID group-to-role mapping drives automatic role assignment on first sign-in. Configuration lands in 2 to 4 hours.

How deep is the audit log and what is the retention policy?

The audit log captures record read, record write, configuration change, user permission change, AI call, and integration event with 90-day default retention tunable per tenant up to seven years for compliance. The log supports export to SIEM (Splunk, Microsoft Sentinel, Elastic, Chronicle) through the webhook spec with HMAC signing and the published API. For teams with heightened compliance requirements the retention can set to the regulatory ceiling (HIPAA 6 years, SOC 2 1 year typical, HITRUST varies by control).

What is the HIPAA posture and how do we sign the BAA?

Strkr is HIPAA compliant with a Business Associate Agreement available on request on the business plan (below the enterprise tier most CRMs gate HIPAA behind). The BAA signing process typically runs 1 to 3 business days with Strkr Legal reviewing the mutual terms. The BAA covers the standard HIPAA requirements including PHI handling, breach notification, and sub-processor obligations. The audit log preserves every PHI access for the HIPAA compliance posture review.

How does the pen test and vulnerability management program work?

Strkr runs quarterly external penetration tests through a reputable third-party firm with the executive summary published to prospects in the security review (findings count by severity, remediation status, next pen test date). The detailed report delivers under NDA. Vulnerability scanning runs continuously through the CI/CD pipeline and the production infrastructure. Vulnerability remediation targets 15 days for critical, 30 days for high, 60 days for medium. Incident response program documentation delivers with the compliance package.

What is the data residency and encryption posture?

Data at rest encrypts with AWS KMS. Data in transit encrypts with TLS 1.2 or higher. Primary data residency is US (AWS US-East-1 and US-West-2 for redundancy). EU data residency is on the compliance roadmap for 2027. Integration tokens live in AWS KMS. Platform credentials live in AWS Secrets Manager. Multi-tenant separation enforces at the application layer with row-level security on every query. The published sub-processor list carries contact detail for each sub-processor.

Also built for

Related audiences.

MSSP CRM HIPAA Compliant CRM Enterprise Mid-market Cybersecurity CRM Financial Services CRM

Try it free. Bring your team next week.

No sales call, no migration consultant, no four-month implementation. Enter your card, get 14 days of the full Pro tier, cancel any time before day 14 with zero charge. Spin up a workspace, import your CSV, and have something useful before lunch.

Start free trial See pricing