Smaply

Smaply hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Security isn't a single yes/no, but Smaply is SOC 2 Type II compliant and holds ISO 27001, SOC 2 Type II, GDPR. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Smaply hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@smaply.app or via a /security page.

Smaply lists 8 subprocessors on its trust center, including Google Cloud Platform, Vercel, Usersnap GmbH, Freshdesk, ActiveCampaign. Buyers use this for fourth-party risk review.

Smaply hosts on GCP, and handles Credit card information, Personal health information, Customer PII (Name, Email, IP Address, Device Information). Data residency details are on its trust center.

Smaply's trust center is at https://trust.smaply.app. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Yes. Single Sign-On (SSO) is free of charge for 10 users onwards. You can still use SSO fewer than 10 users, with additional cost. MFA can be enforced via the connected identity provider (IdP). However, please not that you cannot use both SSO and MFA at the same time.

Encryption is applied to protect data at rest and in transit using strong cryptography and industry-standard protocols, including AES-256 and TLS 1.3, with cryptographic protection of passwords.

Our access to customer data is strictly limited, role-based and governed by our ISO 27001-aligned Information Security Management System. Only authorised personnel (specifically, selected engineering or operations staff) may access customer data, and only when necessary for support, maintenance or legal obligations. Such access is granted on a least-privilege basis, logged and monitored, and subject to defined security policies, confidentiality obligations and contractual data protection agreements. No Smaply personnel have routine or standing access to customer content. Access is event-driven, auditable and governed by our internal access control policies.

No. Smaply uses ephemeral processing via Google's Generative AI API. Your data is: 1. Not Stored: Customer data is processed transiently in-memory only and never persisted by Google or Smaply. 2. Not Used for Training: Per Google's API terms of service, data sent via the Generative AI API is not used to train, fine-tune, or improve models. 3. Not Shared: Your data is never shared with third parties or used for any purpose beyond generating the specific response you requested. Verification: This guarantee is contractually enforced through our Google Cloud AI Platform agreement. Enterprise customers can request a copy of our Data Processing Addendum (DPA) for legal review.

We operate on a hybrid cloud infrastructure powered by Google Cloud Platform (GCP) within the European region. - Primary data center: Frankfurt am Main, Germany - Backup data center: Belgium This setup ensures high availability, redundancy, and compliance with European data protection standards. Additionally, we offer single-tenant hosting options tailored to your preferred location and tenancy requirements. (Additional costs may apply depending on your subscription level.)

Yes. Security issues and other software incidents are handled according to our internal Service Level Agreement (SLA), where each reported issue is assigned a severity level (S1–S4) based on its impact on the system and customers. Our team prioritizes investigation and resolution depending on this severity classification. Typical resolution targets are: - S1 – Critical issues (e.g., service unavailable, data loss): Resolution within 3 business days for standard plans and 1 business day for Enterprise plans. - S2 – Major issues (significant feature impact): Resolution within 14 days (standard) or 7 days (Enterprise). - S3 – Minor issues (limited impact): Resolution within 90 days (standard) or 30 days (Enterprise). - S4 – Low-priority improvements or minor problems: Resolution timelines are determined in mutual agreement. For critical incidents (S1 and S2), our team begins working on the issue immediately after it is reported. Our primary objective is to restore normal service operation as quickly as possible. When an immediate fix is not feasible, we prioritize providing a workaround to restore business operations, followed by a permanent solution.

If you believe you’ve discovered a potential security issue, please report it to [privacy@smaply.com](mailto:privacy@smaply.com) with as much detail as possible so our team can investigate. We review all submissions carefully. If your report highlights something we were not previously aware of, we will follow up with you. In cases where the issue is already known or does not require further action, we may not respond individually, but we still appreciate you taking the time to share your findings.

We are currently preparing a formal bug bounty program, which we expect to launch soon. In the meantime, we welcome responsible disclosure. If you believe you have identified a security vulnerability, please send your findings to [privacy@smaply.com](mailto:privacy@smaply.com). Our team will review the report and may grant a discretionary reward based on factors such as: - The potential impact and severity of the vulnerability - How well the issue is documented and reproducible - Whether the finding represents a previously unknown vulnerability - The difficulty of exploiting the issue and the required attack conditions At this stage, we only consider rewards for high-severity security vulnerabilities. Reports related to the following topics are out of scope and not eligible for rewards: - Service disruption attempts such as denial-of-service testing - Minor configuration issues (e.g., DNS records or general infrastructure hygiene) - Social engineering, phishing, or spam-related techniques - Attacks that target employees through physical or social manipulation - Security issues in third-party tools or services that we do not operate or maintain - Vulnerabilities that depend on physical access to a user’s device