SOC 2 and GDPR Intake: From Days to Under Two Minutes
Compliance enquiries were being lost to response time, not to price. Automating 70–90% of intake meant the qualified ones reached a human while they still cared.
- Client
- Compliance services provider
- Industry
- Compliance services
<2 min
Response time, from hours or days
70–90%
Of workflow automated
Standardised
Intake and qualification
Automatic
Routing and scheduling
The problem
Enquiries about SOC 2 and GDPR readiness arrived from a mix of channels and were handled by whoever was free. Response time ran from hours to days depending on the week, and intake questions varied by whoever asked them, which meant two similar prospects could get different recommendations.
Compliance buyers are usually on a deadline — an audit date, a customer requirement, a funding condition. A slow response does not lose the deal on merit; it loses it because someone else replied first.
What we built
A standardised intake sequence that gathers the facts any recommendation actually depends on — framework, scope, current controls, timeline, prior audit history — the same way every time, so the qualification is comparable across enquiries.
A rule-based recommendation layer over that intake, producing a defensible next step rather than an opinion. Compliance is a domain with real answers; a generative free-for-all would have been both unnecessary and dangerous here.
Intelligent routing that classifies the enquiry and sends it to the right person or the right scheduling flow, with automated follow-up so an unanswered thread does not simply expire.
Why the rules stayed rules
The recommendation logic is deterministic on purpose. In compliance, an answer that sounds authoritative and is wrong exposes the client to exactly the risk they were paying to avoid, and "the model said so" is not a position anyone wants to defend.
The language model handles what it is good at — reading unstructured enquiries into structured fields, and writing the response clearly. The decision itself is a rule someone signed off on.
Results
Response time fell from hours or days to under two minutes, and 70–90% of the intake and qualification workflow runs without a person.
Conversion improved for a straightforward reason: prospects reached a substantive answer while they were still in the moment that made them enquire. Follow-ups now happen consistently, and the next step a prospect receives is the same one a colleague would have given them.
What we'd flag
The automation is only as good as the rules behind it, and those need reviewing as frameworks change. This is not a system you deploy and forget — a stale control mapping is a wrong answer delivered fast.
We also kept a hard escalation path for anything unusual. The 10–30% that does not automate is disproportionately the complex, high-value work, and routing it quickly to a person matters more than automating it.
