SmartSuite encrypts data in transit over HTTPS and at rest with AES-256, holds a SOC 2 Type II report and ISO/IEC 27001:2022 certification, and has passed third-party HIPAA and GDPR audits. It runs on AWS, and Enterprise and Signature customers choose a United States or a European Union data center; reports are available on request from your account manager or the sales team.
Plan Availability | All plan types. Two-factor authentication: Professional, Enterprise and Signature. SSO, SCIM, audit logs, IP restrictions, DLP and EU data residency: Enterprise and Signature. |
Permissions | Applies to every workspace and member. Administrators request reports and agreements. |
Platform | Web |
Related Reading |
How is data encrypted?
In transit: every connection between your device and SmartSuite uses HTTPS (TLS).
At rest: stored content is encrypted with AES-256.
Which certifications and audits does SmartSuite hold?
Attestation | Status (www.smartsuite.com/security, read 22 Oct 2026) |
SOC 2 Type II | A SOC 2 Type II attestation report, issued by an independent CPA firm under the AICPA's SOC 2 framework; SmartSuite undergoes an annual SOC 2 Type 2 audit. Contact your account manager or the sales team to request the latest report. |
ISO/IEC 27001:2022 | ISO/IEC 27001:2022 certification, issued by an accredited certification body (pricing page); the certificate is in the Trust Center. See ISO/IEC 27001 & SOC 2 Type II. |
HIPAA | A formal third-party HIPAA compliance audit, conducted by Prescient Assurance; a Business Associate Agreement (BAA) for customers on Enterprise and Signature plans. See HIPAA at SmartSuite: audit report and BAA. |
GDPR | A formal third-party GDPR audit conducted by Prescient Assurance; a Data Processing Agreement (DPA) on request (see SmartSuites Data Processing Addendum). |
PCI DSS | SmartSuite runs on the PCI-compliant AWS platform. |
Accessibility (VPAT) | A Voluntary Product Accessibility Template (VPAT) is available from the Trust Center; request access there or through your account manager. |
Current documents are in the Trust Center; ask your account manager or the sales team for a report.
Where is data hosted?
On Amazon Web Services. Every new workspace chooses where its data is hosted at sign-up: a United States or a European Union data center. Enterprise and Signature customers can also move an existing workspace from the US to the EU. The AWS regions are listed in Choosing Your Data Region; see also Is SmartSuite GDPR compliant and where is my data hosted: SmartSuite and GDPR.
How is data backed up?
Regular backups of production data are stored in a separate, secure location, and every backup is encrypted.
You can keep your own copies: export a table as CSV, or retrieve data through the REST API.
Which sign-in and access controls exist?
Sign in with Google, Microsoft or Apple on every plan.
Two-factor authentication on Professional, Enterprise and Signature (Two-Factor Authentication).
SAML 2.0 or OIDC single sign-on, SCIM provisioning, audit logs, IP address restrictions and data loss prevention on Enterprise and Signature (Enterprise Security and DLP Controls in SmartSuite).
Permissions at workspace, solution, table, record and field level; activity history on every record; login history and active sessions for every member.
How do I report a vulnerability or get a document?
The security page at www.smartsuite.com/security holds the vulnerability report form and the contact route for reports and agreements. The Terms of Use, the Global Privacy Policy and SmartSuite Subprocessors complete the picture.
Frequently asked questions
The first two questions came from conversations this month.
How do I get the SOC 2 report for a security review?
How do I get the SOC 2 report for a security review?
Ask your account manager or the sales team; the SOC 2 Type II report is provided on request under the terms the security page describes. The Trust Center lists the current documents.
Where is my workspace's data stored?
Where is my workspace's data stored?
In a United States or a European Union data center on AWS, chosen when the workspace was created (Choosing Your Data Region lists the regions). To confirm the region of a specific workspace, ask Support through the in-app chat with the workspace ID.
Is SmartSuite HIPAA compliant?
Is SmartSuite HIPAA compliant?
SmartSuite has undergone a formal third-party HIPAA compliance audit, conducted by Prescient Assurance, and can enter into a Business Associate Agreement (BAA) for customers on Enterprise and Signature plans.
Does SmartSuite publish a VPAT?
Does SmartSuite publish a VPAT?
Yes. A VPAT (Voluntary Product Accessibility Template) is available from the Trust Center at trust.smartsuite.com; request access there or through your account manager or the sales team.
Last verified 23 Oct 2026.