Audience: IT / procurement / Compliance who say "SOC2, DPA, pen test, insurance or park it."
Product: SettleUp Collections - Level-4 refuse gate for dispute letters + Admin / Contributor / Compliance roles. Human owns Send. Not legal advice.
Collections and billing messages, drafted and checked by AI, sent by your team. In a pilot, each message is checked against the account before your team sends it.
Owner: Nathan Platter, Builder of Hold the Send · Contact: nathanplatter@gmail.com
Updated: 2026-09-07 · Evidence rule: VERIFIED = confirmed in live product / Stripe / Pages / SoT. ASSUMPTION = labeled; ask before treating as contract fact.
This is a growth-partner sheet, not a peacock badge wall. We tell you what we store, what we refuse to claim, and how to unblock vendor review without waiting on a fake SOC2 sticker.
| Topic | Status | Honest answer |
|---|---|---|
| Dispute-letter drafts, refuse reasons, role actions in the product console | **ASSUMPTION** (Pilot shape) | Pilot is built around gate + roles + HITL. Expect account metadata, drafts, ledger facts *you* supply for a review, and refuse/pass outcomes. Exact schema and retention days are confirmed in onboarding, not invented here. |
| Payment / billing identity | **VERIFIED** | When a Pilot is opened after intro, billing can run on **Stripe**. Card data is handled by Stripe, not by us inventing a card vault. This page is not a checkout. |
| Public demos | **VERIFIED** | Demo / sibling landings often host on **GitHub Pages**. Demo paths use **synthetic / fixture** data labeled as such. |
| Production AMS / dialer / payment write-back | **VERIFIED non-goal (current)** | We are not your CMS, dialer, or payments rail. Production ledger sync = SettleUp Firm / post-MVP honesty - we will not pretend Pilot already syncs your live book. |
| Consumer PII beyond what you paste/upload for a gated letter | **ASSUMPTION** | Minimize what you put in Pilot until DPA + retention are signed. Do not dump full portfolios "just to try it." |
| We do **not** store | **VERIFIED intent** | We do not claim to hold your entire AMS database, call recordings, or payment tokens. If a future integration needs more data, that is a scoped change, not a silent expand. |
Booth line: "We gate letters you choose to run through the console. We are not asking for your whole book on day one."
- VERIFIED product rule: Human owns Send. SettleUp refuses or remediates; it does not auto-mail consumers or auto-submit regulator portals for you.
- Level-4 refuse gate: Missing / mismatched ledger facts → REFUSE, not a prettier hallucinated letter.
- Not legal advice. Your Compliance / counsel still owns exam risk and final wording.
- Never CFPB-approved (see §6). HITL is the control that makes that refusal honest instead of scary.
Buyer takeaway: Vendor risk is "bad draft leaves the building." Our design answer is refuse + human Send, not a certification sticker.
| Role | Intent (product story) | Status |
|---|---|---|
| **Admin** | Seat / config / who can operate the console | **VERIFIED** as named role in hero / booth console |
| **Contributor** | Draft / remediate path inside the gate | **VERIFIED** as named role |
| **Compliance** | Oversight / career-protection path on refuse vs send | **VERIFIED** as named role |
ASSUMPTION until your Pilot workspace is provisioned: exact SSO, MFA, audit-log export, and seat caps for Pilot vs SettleUp Firm. Ask for the live matrix in onboarding; do not assume Okta-ready enterprise IAM on day-one GitHub Pages demos.
Booth line: "Roles exist so Compliance can see the refuse, not so a bot Sends under someone's badge."
| Vendor / surface | Use | Status |
|---|---|---|
| **Stripe** | Billing when a Pilot is opened after intro (not a public checkout) | **VERIFIED** as billing partner |
| **GitHub Pages** (and related GitHub static hosting) | Public demos / sibling landings | **VERIFIED** for demo hosting pattern |
| Application backend, email, file storage, auth IdP, logging, AI model host | Production Pilot runtime | **UNKNOWN / confirm at DPA** - we will not invent vendor names here |
If procurement needs a subprocessor list for signature, email nathanplatter@gmail.com with subject SettleUp DPA / subprocessors. You get the current list for *your* Pilot environment, not a brochure fiction.
1. Email nathanplatter@gmail.com with subject SettleUp DPA request.
2. Include: legal entity name, primary contact, whether a Pilot is pending after intro, and any must-have clauses (deletion, subprocessors, breach notice window).
3. Template status (honest): ASSUMPTION / gap labeled - a polished mutual DPA pack is not claimed as "SOC2-ready downloadable PDF on the marketing site." We work the DPA as a growth-partner Pilot artifact, not a stall weapon. Expect a working draft path on request; do not assume a pre-signed enterprise MSA library exists.
We would rather send a thin honest DPA than a thick fake one.
Treat the following as not true / not claimed unless Nathan sends a dated artifact that says otherwise:
- SOC 2 (Type I or II) - not claimed
- ISO 27001 / HITRUST / FedRAMP - not claimed
- CFPB-approved / regulator-endorsed - never claimed (product lock)
- Pen-test badge / continuous red-team report - not claimed
- Cyber insurance limits / COI dollar amounts - UNKNOWN; do not invent numbers in vendor packets
- "Enterprise-grade" as a substitute for evidence - we say bootstrap + HITL + refuse gate instead
If someone on our side peacocked a badge in a Slack thread, this sheet wins.
| Data | Synthetic / fixtures, labeled | Your chosen letter packs / facts you provide | Ledger sync & deeper write paths |
|---|---|---|---|
| Goal | Breakable refuse proof | Gate + roles + HITL on real work you select | Post-MVP / SettleUp Firm honesty when built |
| Status | **VERIFIED** demo pattern | **VERIFIED** intro-then-Pilot path; workspace details in onboarding | **ASSUMPTION / roadmap** - not sold as already done |
Hard honesty: Fixtures prove the gate. They do not prove your AMS. A Pilot, quoted after intro, is the path to run *your* letters under human Send without pretending full production ingestion exists today.
Copy/paste for IT / procurement. Check what you actually need for a Pilot after intro, not a Fortune-50 RFP.
- [ ] Confirm product job: dispute-letter refuse gate + roles, not AMS/dialer/payments replacement.
- [ ] Confirm control: human owns Send; refuse-over-hallucinate; not legal advice; not CFPB-approved.
- [ ] Scope data: start with minimal accounts / drafts; no full-book dump until DPA signed.
- [ ] Request DPA via nathanplatter@gmail.com (subject above); attach your standard questionnaire trimmed to Pilot scope.
- [ ] Ask for current subprocessor list for your Pilot env (Stripe verified; others confirmed in writing).
- [ ] Accept honest gaps: no SOC2 / no pen-test badge claimed; Nathan Platter, Builder of Hold the Send; GitHub Pages = demo proof, not the whole trust story.
- [ ] Define Pilot success in writing: e.g. N letters gated, refuse rate reviewed by Compliance, human Send only.
- [ ] Park "insurance COI + SOC2 or kill" only if your policy truly requires it for this dollar / data class. If policy allows Pilot with DPA + HITL controls, do not invent a park.
- [ ] Owner on your side: name one Compliance + one Ops owner so "vendor review" cannot float forever.
- [ ] Growth-partner frame: Pilot is a hold and prove, not a 90-day RFP burial.
Crush line for the stall: "We can DPA the Pilot and keep human Send. We will not fake SOC2 to make a questionnaire feel finished."
"IT will ask for SOC2. Fair. We are bootstrap. What we *will* give you: Stripe for money, Pages for breakable demos, Level-4 refuse, Admin/Contributor/Compliance, human Send, a real DPA path, and an honest 'not yet' on badges. If your policy needs SOC2 before any Pilot data, say so up front. If it needs a DPA and clear HITL, we can unblock this week."
*SettleUp Collections · Security & DPA FAQ · for CoS / vendor review · overwrite-safe one-pager*
Talk first · no public list · no peacock SOC2 · cutover LOCK (hosted /app is 404).