Security, confidentiality and data handling at Siete

Confidentiality and NDA

Siete signs a mutual NDA with every client before receiving sensitive information, and can use either its own NDA template or the client's.

Several of Siete's contracts are carried out under NDA. The agreement is signed before the client shares sensitive information, such as access to its CRM or details of its sales strategy.

Confidentiality of the Siete team

Everyone who works at Siete signs confidentiality clauses and receives data handling training during onboarding.

Publishing case studies and benchmarks

• Case studies: Siete only publishes case studies with the client's authorization. You can see the published ones in case studies.
• Benchmarks: Siete publishes benchmarks with aggregated data and no client names. One example is the software prospecting benchmark.

How Siete handles data

Siete acts as data processor on behalf of the client: the client owns the data, the prospect database generated and the conversations with those prospects.

What data Siete processes

• B2B prospect contact data: professional information about the people Siete contacts by email and LinkedIn on the client's behalf.
• Access to the client's CRM: when the service requires it, to log contacts, conversations and meetings.
• Campaign conversations: prospect replies, which belong to the client.

Where the data is stored

Data is preferably stored in the client's CRM: Siete works with HubSpot, Salesforce, Pipedrive or any other CRM the client already uses. Operational campaign data lives in Siete's prospecting tools, with access restricted to the team assigned to the account.

Who can access the data

Only the Siete team assigned to the account has access, through named accounts, two-factor authentication and least-privilege access. Details are in operational security.

Retention and deletion

When the contract ends, the data and the database generated stay in the client's CRM or are exported to the client. Siete deletes them from its tools within 30 days after the end of the contract.

Regulatory compliance

Siete operates in line with the data protection laws of Uruguay, Brazil, Argentina, Colombia, Mexico, Chile and Peru, and applies GDPR criteria when prospecting in the European Union and CAN-SPAM criteria when prospecting in the United States.

Responsible email practices

• Opt-out: every contact can unsubscribe. Siete honors opt-outs immediately and records them in a suppression list shared with the client.
• Secondary domains: Siete sends from secondary domains set up for the campaign, with SPF, DKIM and DMARC. Siete never sends from the client's main domain, to protect its email reputation.
• Warm-up and volume: Siete warms up every new domain before using it and increases sending volume gradually to protect deliverability.

Operational security

Siete controls access to its clients' data with named accounts, two-factor authentication, least-privilege access and revocation of access when each engagement ends.

Access control

• Named accounts: each person uses their own account. Siete does not use shared users.
• Two-factor authentication (2FA): enabled on team accounts.
• Least privilege: each person at Siete only sees the client accounts they work on.
• Revocation: Siete revokes access when someone leaves the team or when the engagement ends.

Siete's tool stack

Onboarding and offboarding

When joining, each person at Siete signs confidentiality clauses and receives data handling training during onboarding. When a person leaves the team, Siete revokes their access.

Use of artificial intelligence with client data

Siete uses AI for research and writing. Siete does not use client data to train models and does not upload confidential information to AI tools that use it for training.

Certifications

Siete does not hold its own certifications such as ISO 27001 or SOC 2.

Instead, Siete applies its own controls and works on tools from vendors that hold their own security certifications, such as HubSpot, Google Workspace and LinkedIn.

Controls Siete applies

• Mutual NDA before receiving sensitive information, and a DPA at the client's request.
• Named accounts, two-factor authentication and least-privilege access.
• Access revocation when someone leaves the team or the engagement ends.
• Confidentiality clauses and data handling training for the whole team.
• Deletion of data from Siete's tools within 30 days after the end of the contract.

If your evaluation process requires evidence of these controls, Siete completes your company's vendor security questionnaire. You can request it through contact.

SLAs and service model

Siete gets the operation up and running in 2 to 3 weeks, responds to data or security incidents within 24 business hours and assigns an account manager to every account.

SDR replacement applies to the SDR staff augmentation service.

Documentation available for Procurement

Siete provides four documents on request for procurement processes: a mutual NDA, a DPA, a completed vendor security questionnaire and the company's legal and tax certificates.

How the vendor evaluation process with Siete works

Evaluating Siete as a vendor follows five steps: intro call, NDA, security questionnaire and DPA, proposal and contract, and onboarding.

1. 1

   Intro call

   Your team and Siete review goals, markets and scope of the service.
2. 2

   NDA signature

   Siete signs a mutual NDA, with its template or your company's, before receiving sensitive information.
3. 3

   Security questionnaire and DPA

   Siete completes the vendor security questionnaire and signs the DPA if your company requests it.
4. 4

   Proposal and contract

   Siete presents the proposal with scope and SLAs, and both parties sign the contract.
5. 5

   Onboarding

   Siete gets the operation running in 2 to 3 weeks, with named accounts and an assigned account manager.