Security & compliance
The most sensitive data you hold, held properly.
Certified, UK-only, and governed from collection to disposal.
- ISO/IEC 27001:2022Certified by BSI · IS 811455Independently audited information security management across the platform.
- Cyber Essentials PlusCertifiedUK government-backed cyber security baseline, independently audited.
- UK-onlyProcessing
- NHS DSPT, Liberty Global GTCPast responses to UK public-sector and commercial-enterprise procurement standards available on request.
Your data stays yours
Your data stays yours.
Disclosure means handling the most sensitive material an organisation holds. These are the promises we make about it.
Never shared with third-party AI providers
We never share your data with third-party AI providers.
Ethically trained AI
Our models are trained on our own content, on synthetic data we generate, and on sources we hold written authorisation to use. Never on customer material.
Encrypted at rest and in transit
All data is encrypted at rest with AES-256 and in transit with TLS 1.2 or later.
UK-only processing
Your data is processed in the UK.
Single sign-on with Microsoft 365
Sign in with Microsoft 365, with multi-factor authentication enforced.
Access only with your approval
Support staff reach your environment only with your approval, and every access is logged.
The controls behind the certifications.
Tenant isolation and data residency
Logical isolation per tenant on Public Cloud (UK AWS regions). Physical isolation on Private Cloud (single-tenant deployment, dedicated AWS account, per-tenant encryption keys). BYOC (Bring Your Own Cloud) for customers whose data must stay in their own cloud organisation, where the environment is theirs and we have no visibility of it at all.
Access only with your approval
Support staff reach your environment only with your approval, and every access is logged. Smartbox is software, not a managed service: there is no review team here reading your files.
Customer-hosted deployments go further still — where you run Smartbox in your own cloud organisation, the environment is yours, we do not operate it, and we have no access to it at all. That is also why the question of SC-cleared personnel does not arise: clearance governs the people who access material, and on a Smartbox deployment those people are yours.
Your data is not our training data
We do not train on customer material. Our models are trained on our own content, on synthetic data we generate, and on sources we hold written authorisation to use — with a named owner and a date against that authorisation. Nothing you put into Smartbox teaches the model, and nothing another customer puts in has taught the one that reads your files.
Identity, access and audit
Single sign-on with Microsoft 365, and enforced MFA. Role-based access control — Reviewer, Redactor, Approver, Admin — with per-matter overrides and matter-level information barriers. Immutable audit log across every user action, exportable for compliance review.
Encryption, integrity and malware
AES-256 at rest, TLS 1.2+ in transit, per-tenant encryption keys on Private Cloud. Antivirus scan on every file at ingestion — reviewers never open an infected attachment. Every file fingerprinted with SHA3-256 at ingest, and every lifecycle event written to an append-only, hash-chained ledger.
UK GDPR and DPA 2018
Aligned by design. The platform is engineered for UK regulatory work.
Governance, built in
From collection to disposal, on the record.
- Chain of custody
- Every lifecycle event is hash-chained, and every redaction is recorded with its reviewer.
- Legal hold
- Holds block deletion and release while a matter is live.
- Retention schedules
- Material is kept for as long as your schedule says, and no longer.
- ROPA support
- Your Record of Processing Activities, kept alongside the work.
- One way out
- Nothing leaves except through one release point, with approval wherever your workflow requires it.
Assurance at a glance
- ISO/IEC 27001:2022, certified by BSI — certificate IS 811455.
- Cyber Essentials Plus certified.
- UK-only processing.
- Weekly automated penetration testing by a CREST-accredited provider.
- Support staff reach your environment only with your approval, and every access is logged.
- Every lifecycle event is hash-chained, and every redaction is recorded with its reviewer and the document hash.
- No generative model decides what is withheld, and the same input always gives the same result.
Built for procurement
- ISO/IEC 27001:2022 certified by BSI (IS 811455)
- Cyber Essentials Plus certified
- UK-only processing
- Weekly automated penetration testing by a CREST-accredited provider
- Support access only with your approval
Frequent procurement questions
Where is data hosted?
UK AWS regions by default. Private Cloud deployments run in a dedicated AWS account. For customers who need the environment entirely under their own control, Smartbox runs in your own cloud organisation.Will the audit trail stand up at Tribunal?
Files are fingerprinted with SHA3-256 at ingest. Every lifecycle event — ingestion, classification, redaction, override, disclosure — is then written to an append-only ledger where each row is SHA-256 hash-chained to the one before it, so tampering is detectable by re-verification. Nothing updates or deletes a row. The trail is exportable for ICO submissions and reconstructable at Tribunal.Do your staff need security clearance to handle our data?
No. Support staff reach your environment only with your approval, and every access is logged. Smartbox is software, not a managed service, so there is no review team here handling your files. Customers who need the environment itself under their own control run Smartbox in their own cloud organisation, where we have no access at all.
For IT, security and procurement
Running the review? Start with the pack.
Request the procurement pack for your security and procurement review, or talk it through with us.
