Enterprise-level security and trust

ISO/IEC 27001

ISO/IEC 27001:2022 is the international standard from ISO and IEC for information security management systems (ISMS). SmartSuite's certification recognizes the strength of our information security management system. Please contact your account manager or sales@smartsuite.com for more information.

SOC-2 Type 2

SmartSuite also holds a SOC 2 Type II attestation report, issued by an independent CPA firm under the AICPA's SOC 2 framework. The report stands as proof of our dedication to securing your data while it resides within our systems. SmartSuite undergoes an annual SOC 2 Type 2 audit, demonstrating our ongoing commitment to meeting the most rigorous security, availability and confidentiality standards in the industry. Please contact your account manager or sales@smartsuite.com to request SmartSuite's latest report.

HIPAA

HIPAA, or the Health Insurance Portability and Accountability Act of 1996, is a U.S. federal law whose Privacy and Security Rules are issued by the U.S. Department of Health and Human Services (HHS). It serves as a national standard to protect the security and privacy of protected health information (PHI). SmartSuite has undergone a formal third party HIPAA compliance audit, conducted by Prescient Assurance. Businesses subject to HIPAA can confidently use SmartSuite to support HIPAA-compliant work management.

‍

Please contact your account manager or sales@smartsuite.com if you are interested in signing a BAA with SmartSuite.

GDPR

Privacy and security are fundamental to SmartSuite’s product development and customer service. We rigorously assess all our practices to safeguard your information. In alignment with Europe’s General Data Protection Regulation (GDPR), SmartSuite has undergone a formal third-party GDPR audit conducted by Prescient Assurance.

‍

SmartSuite not only complies but also assists our customers in doing the same. Our advanced permissions model supports access control at the workspace, solution, record and field levels to ensure the security of your organization's data.

‍

For detailed insights into how we handle customer data, please refer to our global privacy policy.  Contact your account manager or sales@smartsuite.com if you are interested in entering into a Data Processing Agreement (DPA) with SmartSuite.

AWS Cloud
Platform

For your uncompromising security, SmartSuite is hosted by Amazon AWS, whose compliance programs include PCI-DSS, HIPAA/HITECH, FedRAMP, FIPS 140-2, NIST 800-171 and GDPR.

Advanced
Permissions

Easily restrict access by member and team or use advanced settings to assign Admin, Editor, Contributor or View-Only access to teams or individuals.

Authentication
‍
Methods

SmartSuite supports secure cloud authentication using Google, Microsoft and Apple accounts to reduce the burden of login for users. Available for Web and mobile (iOS and Android), this option allows for the use of existing accounts to log in to SmartSuite - no need for an additional password.

Two-Factor
‍Authentication

Professional and Enterprise accounts come with an added layer of security by requiring additional information in addition to a username and password. Users have the option to receive a text message on their mobile device or use a code from an authentication app to complete their login process.

IP Address
Restrictions

SmartSuite includes an advanced security feature: the ability to specify IP Address Restrictions for your Workspace. With IP allowlisting, you can establish a whitelist of trusted IP addresses or IP ranges. Users will only be granted access to your workspace if they connect from these authorized addresses, enhancing security and control over your environment.

Session Management

SmartSuite supports auditing of Member sessions, allowing admins to access detailed login information to monitor user activity and behavior. SmartSuite Administrators can choose to terminate any active session, providing control and the ability to enforce security measures. This monitoring suite equips SmartSuite admins with the tools to safeguard the integrity of SmartSuite and your organization's data.

Data Loss Prevention (DLP)

SmartSuite supports a robust API infrastructure designed to integrate with third-party vendor services that monitor the inflow and outflow of sensitive data to the platform. These systems empower administrators with proactive capabilities to safeguard the integrity and confidentiality of critical information. By leveraging this functionality, organizations can implement comprehensive data protection measures, ensuring compliance with regulatory standards and bolstering the security posture of their SmartSuite environment.

Single Sign-On (SSO)

Empower members to use their existing corporate credentials to log in to SmartSuite—no extra passwords required. Our SSO engine supports standards-based federation (SAML 2.0 or OIDC) with leading identity providers such as Microsoft Entra ID (Azure AD), Okta, and Ping Federate, giving IT teams a centralized way to enforce MFA, conditional access, and other directory-level controls.

SCIM User Management

Go beyond authentication and keep workspace memberships perfectly in sync. SmartSuite’s System for Cross-domain Identity Management (SCIM) service automatically provisions new employees, updates profile attributes, assigns them to the right Teams, and de-provisions departing staff based on the authoritative data in your IdP.

‍