Security questionnaires punish vague answers. Marketing pages punish honest ones. Agencies stuck in the middle need plain language: what "in progress" means, what it does not mean, and what you should still ask a vendor before you put client data in their workspace.
GTM's public posture is intentional: SOC 2 Type II is in progress, not complete. ISO 27001 is in progress, not certified. This post explains that phrasing without theater, and without pretending a blog post is an audit report.
First precision: SOC 2 is not a certification
People say "SOC 2 certified" in sales decks. The accurate framing is different. SOC 2 is an attestation under AICPA standards: a licensed CPA firm examines controls and issues a report. You hold a SOC 2 report (Type I or Type II). You are not "certified by SOC 2" the way a product gets a consumer safety mark.
Type I looks at control design at a point in time. Type II tests operating effectiveness over a review period (often months). Enterprise buyers usually want Type II because it shows the controls worked across time, not only on the day someone wrote the policy.
Until a CPA firm has issued a report, phrases like "SOC 2 compliant" are marketing. The honest interim sentence is that a SOC 2 Type II examination is in progress (or that readiness work is underway), with detail under NDA when a buyer needs evidence.
ISO 27001 is a certification path, still not a badge you invent early
ISO/IEC 27001 is a certifiable information security management system standard. Accredited certification bodies run a staged audit process. Teams typically move through gap assessment, ISMS build, evidence gathering, internal audit, then Stage 1 (documentation / readiness) and Stage 2 (implementation / effectiveness). A certificate comes after a successful certification decision, not after buying a policy pack.
So "ISO 27001 in progress" can mean anything from early gap work to Stage 2 fieldwork. Buyers should ask which stage, who the certification body is (when engaged), and what scope the ISMS covers. "In progress" alone is a status, not a finish line.
What GTM says today (and what we are not saying)
From GTM's product posture:
- SOC 2 Type II: in progress, not complete / not a held report you can pretend exists
- ISO 27001: in progress, not certified
- GDPR: data model built with GDPR in mind; product is US-only today
- CCPA: controls being verified
- HIPAA: not in scope
- Data residency: US
us-east-2
We will not decorate that list with fake badges, invented audit dates, or customer names. If a detail is not ready for a security packet, it stays out of the blog.
GTM is built by founders Joe Brennan and Tim Chao out of Dallas, TX, and is self-funded. That does not replace an attestation. It is context for why we prefer boring honesty over a logo wall.
What agency buyers should ask any vendor (including us)
When a vendor says "SOC 2 / ISO in progress," ask:
- Which exact track? SOC 2 Type I vs Type II? ISO 27001 certification vs. informal alignment?
- What stage? readiness, review period running, fieldwork, Stage 1, Stage 2?
- Who is engaged? CPA firm for SOC, accredited certification body for ISO, names under NDA are normal.
- What interim evidence exists? policies, architecture overview, penetration-test executive summary, questionnaires (CAIQ/SIG), engagement letters.
- What is in scope for your use case? client prospect data, mailbox connectivity, subprocessors, logging.
- What is explicitly out of scope? For GTM, HIPAA is out of scope, do not force a healthcare story that is not there.
- How are client boundaries enforced? isolation, access control, retention, suppression after purge.
If the vendor cannot answer stage and scope, "in progress" is doing too much work.
Useful external primers for buyers include practitioner explainers on SOC 2 in-progress customer communication and the attestation-vs-certification distinction, use them as literacy aids, not as GTM's audit status.
Controls that matter for outbound even before the report lands
Agency outbound tools touch prospect data, email infrastructure, and sometimes LinkedIn connectivity. While attestations mature, operators should still demand concrete product controls:
- Client-isolated workspaces so lists, domains, inboxes, and suppressions do not mix
- Provenance on fields so you can answer where an address came from
- Retention anchored to collection date with suppressions that survive purge
- Fail-closed send path. In GTM, no send without a compliance verdict and unsubscribe URL
- Least retention for LinkedIn credentials. GTM forwards passwords to the connection vendor and does not persist them
- US residency clarity when the product is US-only
These do not equal a SOC 2 Type II report. They are still the difference between a tool you can defend to a client and a spreadsheet with an API.
How to brief your own client without overclaiming
Agencies get pinched: the end client wants vendor security language, and the vendor is mid-audit. A clean briefing template:
- "The vendor states SOC 2 Type II and ISO 27001 are in progress, not finished."
- "We reviewed interim controls: isolation, send gating, residency, credential handling."
- "We will re-check when the SOC report / ISO certificate is available under NDA."
- "HIPAA is out of scope for this vendor; we will not put PHI in the workspace."
Do not launder "in progress" into "they're secure, chill." Do not refuse every modern tool until a PDF arrives either. Match diligence to data sensitivity and your client's bar.
Packaging is separate from security status
GTM access opens in batches via the waitlist. Onboarding is a one-time fee ($2,000 or $5,000 agreed with sales) that does not include credits. Usage is prepaid monthly funding (minimum $250) converted to data and action credits. None of that is a security control. Do not treat a pricing conversation as a substitute for the questions above.
The standard we are willing to be held to in public
We would rather say "in progress" correctly than ship a badge we did not earn. When status changes, the honest sentence changes with it: from examination underway, to report available under NDA, to ISO certified with scope named.
Until then, judge GTM on the outbound controls you can inspect: client-isolated find → qualify → write → send/reply/book, compliance gate in the send path, and clear limits on what frameworks are and are not claimed.
CTA
If you buy outbound software for agencies and want a vendor that will not fake the security story, join the GTM waitlist.