The social ops platform that clears procurement on the first try.

Honest answers.

• What is your SOC 2 / ISO 27001 status?

  We hold SOC 2 Type II covering Security, Availability and Confidentiality. ISO 27001 is in audit (target Q3) — we share the auditor’s letter and current bridge letter under NDA on request. Penetration test reports from Cure53 are renewed annually and available the same way.

• How does EU data residency actually work?

  At tenant creation we pin your workspace to either eu-west-1 (Frankfurt) or us-east-1 (Virginia). All Postgres rows, asset blobs in S3, pgvector embeddings, and inbox history live in-region. Cross-region replication is opt-in only and disabled by default for EU tenants.

• Can we redline the MSA and DPA?

  Yes. Our default Enterprise MSA, DPA, BAA and security addendum are on the legal pages and we counter-sign within five business days. Standard redlines (insurance, indemnity, audit rights, sub-processors) are routine — non-standard ones go through our GC and rarely take more than two cycles.

• How does SCIM provisioning work with Okta or Azure AD?

  We expose a standards-compliant SCIM 2.0 endpoint. Drop in your Okta or Azure AD app, map groups to PostSyncly roles (Admin, Approver, Editor, Viewer, Client) and provisioning, deprovisioning and group-sync flow automatically. Just-in-time provisioning is available if you prefer.