Security & compliance

Straight answers. No borrowed badges.

We’re an early-stage company. We’d rather tell you exactly where we stand than show you badges we haven’t earned. Updated October 2026.

SOC 2 · readiness under way

SOC 2 Type 1 readiness is under way. We are not yet SOC 2 audited and will publish the status here when that changes. DPA and security questionnaire on request: hello@cullektor.com.

How we protect your data. And your customers.

Least-privilege access

The AR X-Ray connects read-only. Autopilot reads customers, invoices and payments, and does not edit your ledger. Disconnect at any time.

Encryption and logging

Encrypted in transit (TLS) and at rest. Staff accounts use multi-factor authentication, and access to customer data is logged.

Your data doesn’t train AI models

Your financial data and your customers’ emails are used only to run your account, never to train models.

The people on the desk

Specialists work from a secure office in India, working US Eastern hours. They sign confidentiality agreements, are background-checked and work only inside our controlled tools.

We never handle your funds

Customers pay you directly through QuickBooks Payments, Stripe, ACH or check. Cullektor never receives, holds or moves money.

In your name, B2B only

Every message goes from your mailbox using templates you approve. Business invoices only, before any agency. Flat fees, no contingency.

What we are not

Not a collection agency. We don’t buy or take assignment of receivables.
We don’t contact consumers or homeowners. Business AP contacts only.
Invoices over 120 days old or in legal dispute go back to you to decide.

Control

Who can do what. On the record.

Roles keep money decisions with the people who own them. The audit trail shows every action, by person, agent or Desk.

	Owner	Finance	Approver	Desk	Read-only
View AR & reports
Approve messages
Edit playbook & tone
Offer credits or plans
Guardrails & integrations

Desk can propose; an owner approves. SSO / SAML: Coming 2027.

Time	Actor	Event	Object
10:15:02	Agent	Classified reply as Promise to pay (96%)	INV-1036
10:16:40	Jen K.	Approved drafted reply	INV-1036
10:16:41	Agent	Sent from ar@riversidemech.com	msg 7f2c
10:32:18	Priya S.	Logged call: AP confirmed PO 7731-B	INV-1029
11:02:55	Owner	Changed approval threshold $5,000 → $10,000	settings
11:40:09	Sync	Payment recorded in QuickBooks, sequence stopped	INV-1043

Guardrails

Rules it can’t break. Set once.

Approval thresholds, never-contact lists, VIP handling, quiet hours, touch limits and stop words that hand a reply to a person.

Guardrails

Approval aboveA person signs off before any message on larger invoices$10,000
Never contactHarlan Freight, Keystone GC2 customers
VIP accountsWarm tone only, no late-fee mention, owner cc’d6 customers
Quiet hoursNo sends outside 8 AM–6 PM customer time, or weekendsOn
Max touchesAcross email and Desk calls2 / week
Stop wordslawyer, attorney, bankruptcy, dispute → stop + route to a person4 rules

Data flow. Money never touches us.

AR inbox

Gmail / Microsoft 365Sends as you. Replies come back here.

Ledger

QuickBooks OnlineNative. Xero, NetSuite, Sage Intacct, FreshBooks, Zoho Books planned.

CullektorAI agent · playbook · guardrails

Your customers

AP teamsEmails, portal, calls from the Desk

Your team

Approvals & alertsWeb app, Slack, Teams

Human Desk

Trained AR specialistsCalls, disputes, 90+

Payments

Your own processorMoney never touches Cullektor

Now

Encryption in transit and at rest, MFA for staff, logged access, least-privilege ledger scopes.

Under way

SOC 2 Type 1 readiness: policies, vendor reviews, access reviews.

Coming 2027

SSO / SAML, customer-managed data retention settings.

Early access

Cull the overdue. Keep the customer.

Get a free AR X-Ray of your receivables, book a 20-minute demo, or join the trial list. Now onboarding founding customers for January 2027 go-lives.

AR X-RayAging, DSO, slowest payers, what’s collectable in 30 days.
DemoOn sample data, or on your own X-Ray.
Emailhello@cullektor.com