Impact Study

How Popp Won Enterprise Trust With Three Certifications

Popp is an AI copilot for talent and recruitment teams. A founding team with no compliance experience needed to prove enterprise-grade security fast — without stalling product or hiring a security team. So Agency became their security team, taking them through SOC 2, ISO 27001, and HIPAA end-to-end.

SOC 2 ISO 27001 HIPAA

About the Company

Popp AI is an AI copilot for talent and recruitment teams that automates candidate conversations, screening, and application processes. Founded by Sam Dhesi, James Cochrane-Dyet, and Ilyes Benmansour, Popp raised £3.6 million in seed funding led by Emerge and SuperSeed Ventures to make meaningful candidate engagement possible at scale.

Key Challenges

Enterprise clients wanted proof that Popp took security seriously before trusting it with candidate data. The founding team had no prior experience with security compliance, and leadership bandwidth was already consumed by rapid product development.

How Agency Helped

Agency guided Popp’s audit preparation from the earliest stage — pre-product and client readiness — and worked directly with the development team on implementation. A pure automation tool would have handed Popp’s founders a checklist; Agency’s forward-deployed engineers did the work instead — advising the CTO on infrastructure and posture and implementing every framework end-to-end, no new headcount required.

Results

Popp attained SOC 2, ISO 27001, and HIPAA certifications. CTO-level infrastructure advisory hardened the company’s security posture, and the sales team now answers enterprise security questionnaires quickly — closing deals faster with less workflow disruption.

Proof Points

Popp earned SOC 2, ISO 27001, and HIPAA certifications while the founding team stayed focused on product development. The program also turned security questionnaires into a faster enterprise sales motion.

Agency worked directly with Popp from early readiness through implementation, advising the CTO on infrastructure and security posture while operating the frameworks end-to-end.

Buyer Questions Answered

Why did Popp need Agency? Enterprise clients needed proof of security before trusting Popp with candidate data, and the founding team had no prior compliance experience.

What changed for sales? After certification and posture improvements, Popp could answer enterprise security questionnaires faster and with less workflow disruption.

Custom Security To Protect Your Most Critical Threat Surface

Your security and compliance team, without the headcount. U.S.-based forward-deployed engineers, supercharged by proprietary AI, operate your program end-to-end — on top of the tools you already trust. Automation ends where judgment begins.

Assemble Your GRC Team