The new London AE is told to navigate data residency, GDPR and procurement, but the security page answers "Where are you based?" with "The entire company is based out of San Francisco" and says nothing about where data lives. A European security reviewer reads that as a reason to wait.
First action
List the ten questions EMEA prospects asked in security reviews this year and write one-paragraph answers.
How to measure it
EMEA deals passing security review within 3 weeks
- Now
- –
- Target
- 80%
- By
- 1 quarter
Steps
Collect the questions
Pull the last ten EMEA security questionnaires and note every repeated question.
Account Executive, EMEA 1 day
Confirm the facts
Get the hosting region, any EU option and the sub-processor list confirmed by engineering.
Head of Solutions 2 days
Rewrite the FAQ
Replace "The entire company is based out of San Francisco" with the three offices.
Account Executive, EMEA 1 hour
Publish the DPA
Make the DPA and sub-processors downloadable from the trust center.
Head of Solutions 1 day
Build the EMEA page
London team, GDPR answers, certifications and a review booking link.
Account Executive, EMEA 2 days
Use it in outbound
Attach the PDF to first-touch emails to European security-sensitive accounts.
Account Executive, EMEA 1 hour
Review monthly
Add every new question from deals to the page.
Account Executive, EMEA 1 hour a month
Why it works
A short EMEA page and a matching PDF: where customer data is hosted today and any EU option, the DPA and sub-processor list as downloads (not "ask us"), the certifications already held (SOC 2 Type 2, ISO 27001, ISO 42001), the London team, and a 30-minute security review offer. Update the FAQ answer so it names San Francisco, New York and London.
European deals stall in procurement, not in the demo. Pylon already holds the certificates that matter; the gap is that the page does not say so in the words a European reviewer searches for, and the AE is measured on closing in a region where the company looks absent.
Ready to use
ChecklistEMEA security answers to publish
[ ] Where is customer data hosted, by default? [ ] Is an EU hosting option available, and from when? [ ] Download link for the DPA [ ] Current sub-processor list with locations [ ] SOC 2 Type 2, ISO 27001 and ISO 42001 reports: how to request [ ] How AI agents use customer data, and whether it trains any model [ ] Who in London to contact for a security review
Risks and how to handle them
Promising an EU option that does not exist yet
Only state what engineering confirms; say "on request" or "planned" where true.
Legal wording
Have counsel review the DPA summary.
Evidence
- HiringAccount Executive, EMEA (London, posted October 15, 2026): "EMEA is already a meaningful part of Pylon's business, and London is where we're investing next", with a small team being built "across sales, customer success, and support, in a new region and a new office". The AE runs full-cycle inbound and outbound deals, handles "data residency, GDPR, and procurement cycles", and feeds what they learn into "positioning, messaging, and playbooks". Sales stack adds Amplemarket and Salesfinity.Source
- Your websiteTrust & Security page: SOC 2 Type 2, GDPR ("Ask us for our DPA"), HIPAA BAA on enterprise, ISO 27001 and ISO 42001; security reviews and custom MSAs are Enterprise-only. Its FAQ answers "Where are you based?" with "The entire company is based out of San Francisco, CA", and lists "Andreesen Horowitz". Nothing on the page covers where data is hosted or an EU option.Source
- HiringHead of Solutions: Pylon's "first dedicated Solutions leader", owning the technical journey from pre-sales solution design to implementation and long-term success across Sales Engineering, Implementation, Forward Deployed Engineering and Professional Services, with playbooks "that reduce deployment time". The post lists Series B, $51M raised, 100+ employees, offices in San Francisco and NYC, "London coming soon".Source