Smaply

Smaply hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Security isn't a single yes/no, but Smaply is SOC 2 Type II compliant and holds ISO 27001, SOC 2 Type II, GDPR. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Smaply hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@smaply.app or via a /security page.

Smaply lists 8 subprocessors on its trust center, including Google Cloud Platform, Vercel, Usersnap GmbH, Freshdesk, ActiveCampaign. Buyers use this for fourth-party risk review.

Smaply hosts on GCP, and handles Credit card information, Personal health information, Customer PII (Name, Email, IP Address, Device Information). Data residency details are on its trust center.

Smaply's trust center is at https://trust.smaply.app. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Yes. Security issues and other software incidents are handled according to our internal Service Level Agreement (SLA), where each reported issue is assigned a severity level (S1–S4) based on its impact on the system and customers. Our team prioritizes investigation and resolution depending on this severity classification. Typical resolution targets are: - S1 – Critical issues (e.g., service unavailable, data loss): Resolution within 3 business days for standard plans and 1 business day for Enterprise plans. - S2 – Major issues (significant feature impact): Resolution within 14 days (standard) or 7 days (Enterprise). - S3 – Minor issues (limited impact): Resolution within 90 days (standard) or 30 days (Enterprise). - S4 – Low-priority improvements or minor problems: Resolution timelines are determined in mutual agreement. For critical incidents (S1 and S2), our team begins working on the issue immediately after it is reported. Our primary objective is to restore normal service operation as quickly as possible. When an immediate fix is not feasible, we prioritize providing a workaround to restore business operations, followed by a permanent solution.

If you believe you’ve discovered a potential security issue, please report it to [privacy@smaply.com](mailto:privacy@smaply.com) with as much detail as possible so our team can investigate. We review all submissions carefully. If your report highlights something we were not previously aware of, we will follow up with you. In cases where the issue is already known or does not require further action, we may not respond individually, but we still appreciate you taking the time to share your findings.

We are currently preparing a formal bug bounty program, which we expect to launch soon. In the meantime, we welcome responsible disclosure. If you believe you have identified a security vulnerability, please send your findings to [privacy@smaply.com](mailto:privacy@smaply.com). Our team will review the report and may grant a discretionary reward based on factors such as: - The potential impact and severity of the vulnerability - How well the issue is documented and reproducible - Whether the finding represents a previously unknown vulnerability - The difficulty of exploiting the issue and the required attack conditions At this stage, we only consider rewards for high-severity security vulnerabilities. Reports related to the following topics are out of scope and not eligible for rewards: - Service disruption attempts such as denial-of-service testing - Minor configuration issues (e.g., DNS records or general infrastructure hygiene) - Social engineering, phishing, or spam-related techniques - Attacks that target employees through physical or social manipulation - Security issues in third-party tools or services that we do not operate or maintain - Vulnerabilities that depend on physical access to a user’s device