Security & compliance
We find leads ourselves, so the law holds us responsible for that data too. We chose that on purpose. It is why we built six safety features into GTM from the very start.
Where our certifications stand
Programme underway. We are not certified yet.
Working toward it. Not certified yet.
Data model built to it. We serve the US today.
Controls being verified against it.
We do not have any of these yet. We are working toward three of them. The fourth is a set of data rules we built GTM to follow from the start. You will not see an official seal on this page until we have earned it.
The safety check cannot be skipped
A message cannot be sent until it passes the check. If something breaks, the message stops. It never goes out by mistake.
We know where every fact came from
For every fact, we save where it came from, how we got it, and when. That lets us answer when someone asks us to delete their data.
Old data gets deleted on time
We count from the day we collected the data, not the day it last changed. That way nothing is kept forever. Cleanup runs every day.
A stop request lasts forever
If someone tells you to stop, GTM never writes to them again for you. If someone should never hear from anyone, GTM blocks them for everyone. Cleanup never erases these lists.
Stop means stop
If someone replies asking to be left alone, on any channel, GTM stops writing to them everywhere. Nobody has to remember to do it.
AI only sees what it needs
To pick leads, write, and read replies, the AI may see contact details and messages. Our system alerts never include message text, passwords or full web links.
Every campaign sends on its own, and every message goes through the same safety check first. You can read, edit or stop any message before it goes. Sending one yourself does not let it skip the check.
What we have, and what we do not.
Here is the whole picture, good and bad. Some of it a buying team may not like, and we would rather you know now.
- Where data lives
- United States
- SOC 2 Type II
- Working on it, not certified
- ISO 27001
- Not yet
- HIPAA
- Does not apply
- GDPR (Europe)
- Built for it, but US only today
- CAN-SPAM (US email law)
- Always on
- Keeping customers apart
- Every piece of data is locked to one workspace
- Single sign-on and custom data agreements
- Not offered
- Rewards for bug reports
- Not yet. Report by email
Clients do not share one big list. Each client only sends from their own accounts, plus any you choose to share. Each client's lead searches and leads stay in that client's space.
- Every piece of data is locked to one client
- Each client uses their own accounts, never by accident someone else's
- Lead searches and leads stay in that client's space
- A record of who changed people, connections and writing style
Straight answers.
Can I use it for people in Europe?
Not yet. We only serve the United States right now, and every lead GTM finds is in the United States. We built GTM so it could follow Europe's data rules later, but we will not say it is ready before it is.
Are you SOC 2 certified?
Not yet. We are working on it, and our security page shows how far along we are. If you need a signed report today, we are not the right fit yet.
Where is my data kept?
In the United States, in one data center region we picked on purpose. We do not store data in Europe.
What if it makes a mistake?
It will sometimes. It is AI, and AI makes mistakes. So we put hard stops on the mistakes you cannot undo. GTM cannot email someone who asked to be left alone, and cannot keep writing after someone says stop.
Can I take my data and leave?
Yes. Download your contacts as a spreadsheet file at any time. It will load right back in if you return. Cancel from Billing whenever you want.
Who can get into my workspace?
Only the people you add. Every piece of data is locked to your workspace. Access is checked every time, so when you remove someone, they lose access right away.
What happens to my LinkedIn password?
We pass it straight to the company that connects your account, and then it is gone. We never save it, never write it down, and never show it again.
How do I report a security problem?
Email support@trygtm.com. Tell us what you found and how to see it again. Do not include passwords or customer data. We do not pay rewards for reports yet.
Send your security questions to support. A person who built GTM will answer them.
SOC 2 is in progress. We will tell you where it stands, not pretend we have it.