SmartSuite is GDPR-compliant and has undergone a formal third-party GDPR audit conducted by Prescient Assurance; the report, listed as SmartSuite_GDPR_2024, is in the Trust Center. SmartSuite enters into a Data Processing Agreement (DPA) on request, and the DPA text is published on the website.
Plan Availability | All plan types. European Data Residency: Enterprise and Signature (pricing page). |
Permissions | Administrators request the report and the DPA. |
Platform | Web |
Related Reading |
What does the GDPR audit mean?
In alignment with Europe's General Data Protection Regulation (GDPR), SmartSuite has undergone a formal third-party GDPR audit conducted by Prescient Assurance. SmartSuite adheres to a strict privacy policy and is GDPR-compliant to ensure that your personal data is always protected; the Global Privacy Policy describes how customer data is handled.
How do I get the GDPR audit report?
Open the Trust Center at trust.smartsuite.com.
Request access to the document listed as SmartSuite_GDPR_2024, or to Letter_of_Attestation_GDPR + SOC 2.
Optional: ask your account manager or the sales team for the report instead.
How do I get a DPA?
Contact your account manager or the sales team if you are interested in entering into a Data Processing Agreement (DPA) with SmartSuite; the security page gives the contact route. The full text is published on the website's Data Processing Addendum page (Last Modified: January 1, 2026). It incorporates the EU Standard Contractual Clauses (Module Two: Controller-to-Processor) and the UK International Data Transfer Addendum, and its Annex 3 points at SmartSuite Subprocessors. The request steps are in SmartSuites Data Processing Addendum.
Where is my data hosted?
Every new workspace chooses where its data is hosted at sign-up: a United States or a European Union data center. Enterprise and Signature customers can also move an existing workspace from the US to the EU. Choosing Your Data Region lists the regions.
Frequently asked questions
Does the DPA include standard contractual clauses?
Yes. The DPA incorporates the EU Standard Contractual Clauses (Module Two: Controller-to-Processor) and the UK International Data Transfer Addendum (or other applicable UK transfer mechanism).
Where is the subprocessor list?
On the website's List of Sub-processors page (Last Updated: November 10, 2025) and, mirrored, in SmartSuite Subprocessors.
Which plans include European Data Residency?
The pricing page lists European Data Residency on Enterprise, and states that Enterprise and Signature customers can move an existing workspace from the US to the EU. Every new workspace chooses its data center at sign-up.
Last verified 22 Oct 2026 against www.smartsuite.com/security (GDPR audit, auditor, DPA route; read 22 Oct 2026), trust.smartsuite.com (document names), the customer DPA page (transfer clauses, Annex 3) and the subprocessors page. Data residency is from the pricing page