אילו תקנים אנו עומדים בהם, מה בתהליך ומה לא טוענים

מה זה

AICPA framework covering security, availability, confidentiality, processing integrity, and privacy controls for service organizations. Type I is point-in-time; Type II is over a 6–12 month period.

העמדה שלנו

SOC 2 readiness program in progress: access logging, change-management, vendor review, vulnerability scanning, incident response, employee access policy, and least-privilege controls are all in place. Type I attestation targeted for the second half of 2026; Type II to follow once we have operational history.

מה זה

EU regulation governing personal data of EU/EEA residents. Spun typically acts as a data processor; the customer is the controller of their end-user data.

העמדה שלנו

GDPR-aligned controls in place: lawful basis documentation, DPA available on request (with EU Standard Contractual Clauses for international transfers), published sub-processor list, data minimization defaults, retention controls, customer-controlled export and deletion, AI processing disclosure, and breach-notification procedure within the 72-hour requirement.

מה זה

International standard for information security management systems (ISMS). Widely recognized for enterprise / international procurement.

העמדה שלנו

On the roadmap after SOC 2 Type II. Many of the underlying controls overlap with our SOC 2 readiness work, so the incremental effort is significant but not green-field.

מה זה

EU regulation in force since 1 August 2024, with most rules applying from 2 August 2026. Risk-tiered obligations: prohibited / high-risk / limited-risk / minimal-risk AI systems.

העמדה שלנו

Spun's AI features (compose, summarize, transcribe, translate, smart replies, classification) are limited-risk by default — used for general business communication, not high-stakes decisions about people. We provide AI-usage disclosure, customer toggles per feature, audit logging (optional), human-approval modes, no training on customer data, vendor disclosure, and PII redaction before AI processing. If you are using Spun in a use case that becomes high-risk under the Act (hiring decisions, credit, health, education, legal advice, biometric ID), contact us.

מה זה

Israel's privacy law modernized in 2024 (effective August 2025), bringing it closer to GDPR-style obligations.

העמדה שלנו

Spun's GDPR-aligned controls cover most of the core obligations under the updated Israeli law. Database registration: Spun stores customer contact data only to provide the SaaS workspace to each customer — we do not sell, broker, transfer, or independently use customer contact lists. Contact data remains logically separated by organization (RLS-enforced). Spun is not a public body. Under Amendment 13, registration mainly applies to public-body databases and data-broker/direct-mailing databases exceeding 10,000 records; our processor-only model does not trigger registration at launch. We will reassess if Spun offers large-scale direct-mailing/broadcast services, combines contact lists across customers, or transfers contact data beyond listed sub-processors. Hebrew-language privacy materials and DPO designation (if required at scale) are in progress.