Trust & security

Your data,
encrypted and yours alone.

This page is the honest version. What we do, how we do it, and what we have not done yet.

Last reviewed: November 2026

01

Your data belongs to you

SmarCEO never shares, sells, or trains on customer financial data.
You can export everything in CSV or PDF at any time.
Delete your account and your data is wiped within 30 days.
02

How we hold your credentials

Xero and QuickBooks refresh tokens are stored encrypted at rest with AES-256-GCM.
Encryption keys are versioned so we can rotate them without downtime or re-connection.
Keys never leave Vercel's secret store — never in logs, never in code, never visible to Smar staff.
03

Isolation between customers

Every customer organisation has a separate data tenancy.
No cross-tenant query is possible — access is checked on every API request.
Our own internal test organisations use the same isolation as paying customers — no backdoors.
04

Who can see your data inside Smar

Only you and the users you explicitly invite to your organisation.
Smar's superadmin role can impersonate for support, but every impersonation session is audit-logged against the staff member.
We only impersonate when you ask us to — never without.
05

Security hygiene

Magic-link login (passwordless) with a confirmation step that blocks email-scanner pre-fetch.
Two-factor authentication (TOTP) is available for every user; your organisation can require it for every member.
Rate limits on login, signup, admin and OAuth endpoints block scripted abuse.
Full audit log of every administrative action, retained indefinitely.
06

Infrastructure, hosting and compliance

Hosted on Vercel (EU region) with Upstash Redis.
Nightly keep-alive and health checks; public status page live.
GDPR DSAR (data subject access request) process documented; data processor terms available on request.
SOC 2 and ISO 27001 are on the roadmap, not yet certified. We would rather say that honestly than imply otherwise.
Security questions

Need our DPA, SIG, or a direct answer?

Security questionnaires, data-processing agreements, and specific architecture questions are answered by a real person — usually within 48 hours. Email security@smarceo.com.

Reporting a suspected vulnerability? Send it to the same address with "[Vulnerability]" in the subject. We respond to every report; no bounty programme yet, but we send credit where credit is due.

Try it on the
free Starter tier.

You can read every line of this page in action — encryption, isolation, audit log, 2FA — on your own account, with your own data, for £0.

Start free →