What standards we meet, what we're working on, what we don't claim

What it is

AICPA framework covering security, availability, confidentiality, processing integrity, and privacy controls for service organizations. Type I is point-in-time; Type II is over a 6–12 month period.

Our position

SOC 2 readiness program in progress: access logging, change-management, vendor review, vulnerability scanning, incident response, employee access policy, and least-privilege controls are all in place. Type I attestation targeted for the second half of 2026; Type II to follow once we have operational history.

What it is

EU regulation governing personal data of EU/EEA residents. Spun typically acts as a data processor; the customer is the controller of their end-user data.

Our position

GDPR-aligned controls in place: lawful basis documentation, DPA available on request (with EU Standard Contractual Clauses for international transfers), published sub-processor list, data minimization defaults, retention controls, customer-controlled export and deletion, AI processing disclosure, and breach-notification procedure within the 72-hour requirement.

What it is

International standard for information security management systems (ISMS). Widely recognized for enterprise / international procurement.

Our position

On the roadmap after SOC 2 Type II. Many of the underlying controls overlap with our SOC 2 readiness work, so the incremental effort is significant but not green-field.

What it is

EU regulation in force since 1 August 2024, with most rules applying from 2 August 2026. Risk-tiered obligations: prohibited / high-risk / limited-risk / minimal-risk AI systems.

Our position

Spun's AI features (compose, summarize, transcribe, translate, smart replies, classification) are limited-risk by default — used for general business communication, not high-stakes decisions about people. We provide AI-usage disclosure, customer toggles per feature, audit logging (optional), human-approval modes, no training on customer data, vendor disclosure, and PII redaction before AI processing. If you are using Spun in a use case that becomes high-risk under the Act (hiring decisions, credit, health, education, legal advice, biometric ID), contact us.

What it is

Israel's privacy law modernized in 2024 (effective August 2025), bringing it closer to GDPR-style obligations.

Our position

Spun's GDPR-aligned controls cover most of the core obligations under the updated Israeli law. Database registration: Spun stores customer contact data only to provide the SaaS workspace to each customer — we do not sell, broker, transfer, or independently use customer contact lists. Contact data remains logically separated by organization (RLS-enforced). Spun is not a public body. Under Amendment 13, registration mainly applies to public-body databases and data-broker/direct-mailing databases exceeding 10,000 records; our processor-only model does not trigger registration at launch. We will reassess if Spun offers large-scale direct-mailing/broadcast services, combines contact lists across customers, or transfers contact data beyond listed sub-processors. Hebrew-language privacy materials and DPO designation (if required at scale) are in progress.