How Smartbox works

The life of a case.

Seven steps from the first email to the last page released, and what Smartbox does at each one.

Arrive
A request arrives by email and is routed to a new case, with its own inbox. Its workflow starts: the statutory clock runs, an acknowledgement goes out, and the requester gets a secure form for identity and scope.
- Request routed to case
- Case inbox opened
- Clock started · one month
- Acknowledgement and requester form sent
Collect
Material is collected forensically from where it lives, or uploaded. Every item is fingerprinted on arrival and its chain of custody begins. If a matter is live, a legal hold stops anything being deleted.
Understand
Everything is read, including text in embedded images, video and audio. The topic map shows the case as themes and topics across time, so you can scope it before anyone reads a page.
Minimise
Duplicates, near-duplicates, threads, empty folders and known system files on the NIST list come out. Whole topics can be culled from scope. The case dashboard shows what was removed.
Review and redact
Documents are assigned to people or teams and move through automated workflows. The platform proposes redactions; reviewers decide, and each redaction keeps its reason. Comments carry questions and blockers.
Validate and release
The production set is validated at the gate. Redactions are burned into a new copy and checked again, then released through one release point, numbered, watermarked and sealed.
- Reasons complete
- Copies checked
- Numbered and sealed
- Released
Retain
The case and its record are kept for as long as your retention schedule says, recorded in your ROPA, and provable years later.
- Retention schedule
- ROPA entry
- Full audit record

For IT and security reviewers

Sign-in: Single sign-on with Microsoft 365.
Where data lives: UK-only processing.
AI and your data: Never shared with third-party AI providers. Our AI is ethically trained, and never on customer material.
Encryption: All data encrypted at rest with AES-256 and in transit with TLS 1.2 or later.
Certifications: ISO/IEC 27001:2022 certified by BSI (IS 811455). Cyber Essentials Plus.
Exports: Disclosure bundles with index, redaction key and audit log; CSV of detected entities; JSON of the full case record.