Expand your pipeline, not risk exposure
Capture hundreds of leads on the show floor. Popl secures each one through the sales handoff.
Native Integrations
Connect Popl to Salesforce & HubSpot
POPL SECURITY & COMPLIANCE
Secure event lead capture for GTM teams
Fast-track your review from SOC 2 to signed DPA
Protect your pipeline with SOC 2 Type II attested event lead capture. Popl encrypts every lead at rest and in transit. Your data stays in the U.S., not scattered across the globe. And every lead lands where it belongs: your CRM.
Single Sign-On (SSO)
Sign in with Okta, Entra ID, or Google
SOC 2 Type II (Security)
Review Popl's audited security controls
DATA PROTECTION, BY DESIGN
Enterprise-grade security, at show-floor speed
Popl locks down your data, not your workflow. Every lead your team captures is protected with independently audited security, contractual commitments, and continuous control monitoring.
ATTESTATION
SOC 2 TYPE II
Insight Assurance · Security criterion
DATA RESIDENCY
United States
AWS California · Google Cloud Oregon
IDENTITY
SAML SSO + SCIM
Okta · Entra · Microsoft · Google
ENCRYPTION
In transit & at rest
Continuously monitored encryption controls
BREACH NOTICE
72 hours
Contractual, in our public DPA
LEGAL
Full DPA
Published subprocessor list in our Trust Center
PROOF, NOT PROMISES
Is Popl SOC 2 compliant?
Yes. Popl is SOC 2 Type II attested for the Security criterion. Insight Assurance, an independent auditor, spent a full year examining how Popl protects customer data, from access controls and encryption to monitoring and incident response. The audit came back spotless. Zero exceptions. Request the full report in Popl's Trust Center.
SECURE FROM SCAN TO CRM
How Popl protects your data
Every lead is enriched with licensed data, encrypted, and synced to your CRM. Capture with consent when you need it. Your admins control the connection. Your data is hosted in the U.S., start to finish.
CRM INTEGRATION ARCHITECTURE
Built to keep your CRM clean
Popl gives your admin control over which fields get written. Connection is a one-time, company-level OAuth app. Not a managed package. Reps never enter CRM credentials. Duplicate prevention matches on email and phone. Test in a sandbox before production. Check every record in Sync Logs.
DATA STORAGE & RESIDENCY
Your data lives in the U.S. — and stays there
Popl hosts customer data in the United States, on AWS in California and Google Cloud in Oregon. Data is encrypted in transit and at rest. Access to production systems is restricted, logged, and revoked the day someone leaves. Need to verify? Inventory our controls in the Trust Center.
AI DATA ENRICHMENT
Licensed data, always validated
If we enrich it, your team can act on it. Popl queries Apollo, RocketReach, and 18+ licensed data partners in a waterfall, returning verified contact and company data with 99%+ email match rates. All in seconds. And the AI behind it? Built with Anthropic's Claude, named right on our public subprocessor list.
CRM SYNC
Fill your CRM from the floor
Every contact record enters your CRM clean and complete. All in seconds. Prospects route to the right AE in real time. Tags tie closed-won back to the rep and event for crystal-clear attribution.
Trusted by startups & enterprises
Join 2.5M+ professionals, 20K companies, and 90% of the Fortune 500 keeping lead data secure with Popl.
THE SECURITY STACK BEHIND EVERY SCAN
Control your team's access. Know who handles your data
Popl supports SAML SSO and SCIM provisioning, names every subprocessor publicly, and commits to breach notification in its public DPA. For shorter reviews. And faster rollouts.
SSO, SAML & SCIM provisioning
One login for onboarding, offboarding, and everything in between.
Provider
Protocol
Provisioning
Okta
SAML 2.0
SCIM
Azure/Entra
SAML 2.0
SCIM
Microsoft
SSO
Google
SSO
Subprocessors
14 subprocessors. The full list and DPA are public in our Trust Center.
Subprocessor
Purpose
Location
AWS
Hosting
US
Google
Hosting
US
Snowflake
Warehousing
US
Anthropic
AI Enrichment
US
Incident response & notification
If something breaks, you hear about it — in hours, not weeks.
72 hours
Contractual breach notification in our public DPA
Justify every event dollar. Verify every security control
- 150M+digital interactions
- 2M+happy users worldwide
- 150+countries with users
Request a Demo
Watch a badge scan become a complete, verified lead in your CRM in seconds.
CASE STUDIES
Why event teams switch to Popl
Why event teams switch to Popl
How Safeware added $6M in qualified pipeline with Popl event lead capture
How Element451 generated $750K using Popl lead list enrichment
How we generated $4.4M in 3 months using our own platform
How EisnerAmper created $400K+ in new business with digital business cards
How Ivo AI achieved their best event ROI ever with Popl
How RapidSOS collected 1,500+ qualified leads scanned via the Popl badge scanner
ONBOARDING SUPPORT
Go from evaluation to event in 3 steps
Step 1
Evaluate
Structured evaluation on your timeline
Step 2
Connect
SSO and CRM setup with your IT team
Step 3
Roll out
Three one-hour calls to get your team live within 30 days
Is Popl SOC 2 compliant?
Yes. Popl holds a SOC 2 Type II attestation (Security criterion), audited by Insight Assurance with a clean opinion and no exceptions noted. Request the full report in Popl's Trust Center.
Where does Popl store its data?
Popl hosts customer data in the United States, on AWS in California and Google Cloud in Oregon. Data is encrypted in transit and at rest.
Does Popl support single sign-on?
Yes. Popl supports SAML 2.0 SSO with Okta and Azure/Entra, plus Microsoft and Google SSO. SCIM provisioning is supported for member management, with documented walkthroughs for Okta and Entra ID. Current scope: name and email attributes only; group provisioning is not yet supported.
Do end users have to enter Salesforce credentials?
No. The Salesforce connection is a one-time OAuth authorization initiated by your admin; end users capturing leads aren't part of the connection flow. The full setup is documented at docs.popl.co, including object-level permissions for the integration user and the enumerated OAuth scopes, written to be forwarded to your Salesforce administrator.
Can we test the integration in a sandbox before production?
Yes. Sandbox or production is an explicit choice at connection time, documented in the setup guide, so your team can validate the full workflow (capture, enrichment, sync, field mapping) in your test environment before touching production.
Who are Popl's subprocessors, and do you have a DPA?
Yes. Popl publishes its full DPA as a public web page, so you don't have to request it. The DPA includes SCCs with the UK addendum and defines the data categories Popl processes. The complete subprocessor list is published from a single canonical source and shows each vendor's function and location, including hosting (AWS, GCP) and AI enrichment (Anthropic). See all subprocessors.
What happens if there's a security incident affecting our data?
Popl commits to breach notification within 72 hours, published in full in its public DPA. Annual penetration testing with remediation SLAs is part of its monitored controls, published in the Trust Center. Visit the Trust Center.
How does Popl support GDPR compliance?
Popl's GDPR Sensitivity Mode displays a consent prompt before any scan, whether via badge, card, or QR code. The prompt text is customizable, capture forms include an automatic consent checkbox, and it's all admin-controlled. When a contact revokes consent, their lead is deleted in Popl. Read the privacy policy.
What does onboarding look like?
Onboarding runs on a custom 30-day plan with a dedicated CSM for certain Event Lead Capture Teams plans. Week one covers setup: team training, your first Event Flow, and connecting your integrations. By week two, your team captures, enriches, and syncs leads at your first event. The CRM connection is made once, at the company level, with no package to install. During week three, your CSM guides the team through measuring event ROI.