Clients trust Interlock with their sales and revenue data. Here you can see how we protect it, check our compliance status, and request our security documents.
Here you can find our compliance status, request documents, and read about the controls we follow. To get the confidential documents, click "Request access" and complete the short form. You accept our mutual NDA in the form. Current and past clients, and companies we are working with, receive the documents within about 5 minutes; other requests are reviewed by our team first. Last updated: November 4, 2026.
A named Information Security Officer. Written security policies approved by the partners and reviewed at least once a year. Security training at onboarding and every year. Confidentiality terms in every employee and contractor agreement. An annual risk assessment.
Single sign-on with multi-factor authentication required for all personnel. Sign-in methods that cannot use multi-factor authentication are blocked. Least-privilege access, reviewed at least every quarter, and removed promptly when someone leaves.
Each client's files and data are kept separately, with their own permissions.
Data is encrypted in transit and at rest.
Hosted on Microsoft Azure and Microsoft 365 in the United States. We run no physical servers. Separate production and development environments. A web application firewall in front of our platform. Database backups with point-in-time restore.
Inbound links and attachments are scanned, and senders are checked for impersonation.
Code changes are independently reviewed before release and deployed through an automated pipeline.
Centralized logging, kept for at least one year, with threat detection and automated alerts.
Personal devices used for work must meet written minimum requirements: disk encryption, screen lock, a current operating system, and endpoint protection.
A written incident response plan. Clients are notified within 48 hours of a confirmed security incident that affects their data.
Third parties that may process client data on Interlock's behalf. A Statement of Work may narrow this list for a given engagement.
| Subprocessor | Service | Location |
|---|---|---|
| Core infrastructure | ||
| Microsoft (Azure) | Hosting for Interlock's analysis platform, databases and file storage | United States (Central US) |
| Microsoft (Microsoft 365) | Email, SharePoint data rooms, Teams, identity | United States |
| Cloudflare | DNS and network security service in front of Interlock's platform | Global network |
| afi.ai | Backup of Microsoft 365 content | United States |
| AI model providers | ||
| Anthropic | Large language model API (Claude). No training on customer data; 30-day retention | United States |
| OpenAI | Large language model API. All data-sharing settings disabled; 30-day retention | United States; processing may use OpenAI infrastructure in other countries |
| OpenRouter | Model gateway with zero data retention enforced; routes only to US-headquartered model providers | United States |
| Engagement services | ||
| Gainbox Inc. | Operates ICP Studio for ICP projects | European Economic Area (Germany) |
| Fathom | Records and transcribes Interlock-hosted meetings; AI-training exclusion on | United States |
| Collaboration and business systems | ||
| Slack | Internal messaging | United States |
| Atlassian (Jira, Confluence) | Project tracking and documentation | United States |
| HubSpot | Interlock's own CRM | United States |
| Analytics tools | ||
| Tableau (Salesforce) | Dashboards and visualization | United States |
| Alteryx | Data preparation | United States |
| KNIME | Data transformation workflows | Switzerland and European Union |
Click "Request access", use your work email and accept the mutual NDA. Current and past clients, and companies we are working with, receive the SOC 2 Type I report, penetration test letter and Data Processing Addendum within about 5 minutes. Other requests are reviewed by our team first, and the documents are emailed once approved.
Not yet. Our Type II examination is in progress, and we expect the report by the end of November 2026, pending final audit results. We will update this page when the report is issued.
No. Anthropic does not train on customer data, OpenAI data-sharing settings are disabled, and OpenRouter runs with zero data retention. See the subprocessor list for retention details.
In Microsoft Azure and Microsoft 365 in the United States. The subprocessor list shows every third party and its location.
Email our Information Security Officer, Brandon Flowers, at brandon@interlockgtm.com.
Our independent auditor, Ezzy & Associates, issued an unqualified (clean) opinion: our controls were suitably designed to meet the Security criteria as of April 19, 2026.
An independent firm tested our web applications. No critical or high-severity issues; every finding is resolved.
Request our security documents online under our mutual NDA.
Security questions: Brandon Flowers, Information Security Officer, brandon@interlockgtm.com.