Our Commitment
Smartta AI is committed to building a robust security and compliance program. This page provides a transparent overview of our current security measures and our roadmap towards formal certifications. Our security program applies to Smartta Native Services. Resold Services are governed by the security programs of their respective providers. For security questions, contact security@smartplace.ai.
Compliance Status
Privacy and Data Processing
Roles & DPA: We act as a Data Processor for our customers. Our relationship is governed by our Data Processing Agreement (DPA).
Data Usage: Our Data Usage Framework explains how we use data: for required service operations, for opt-out aggregated statistics, and for opt-in AI model training.
Sub-processors: We partner with a limited number of sub-processors. A list is maintained at our Sub-processor Page.
Applicable Law: We process data in accordance with the Australian Privacy Act 1988 and Australian Privacy Principles (APPs).
Security Measures
Encryption
- TLS 1.2+ for all data in transit
- Production data volumes, snapshots and object storage encrypted with AWS KMS (AES-256)
Authentication
- Customer users can sign in with multi-factor authentication (authenticator app or passkey)
Authorization
- Role-based access control (RBAC)
- Tenant-level data isolation
API Security
- JWT-based authentication
- TLS 1.2+ encryption
- Input validation and sanitisation
Infrastructure
Data Residency: Customer workforce data is stored in AWS Sydney (ap-southeast-2). Some supporting services — sign-in, email and SMS delivery, payments, bot checks and AI features — are provided by sub-processors outside Australia; see the Sub-processor List.
Network: AWS load balancer with TLS termination. AWS VPC with security groups for network isolation.
Database: CouchDB, on production data volumes covered by the backups described below.
Application Security
Our development practices include code reviews and automated dependency scanning (GitHub Dependabot) to identify known vulnerabilities in third-party libraries.
Data Backup
Backups: Production data volumes are snapshotted hourly and daily in AWS Sydney, encrypted, and kept for no more than 90 days.
Restore testing: Restore is tested; the last test was on 30 September 2026.
Recovery objectives: Recovery time objective (RTO) 24 hours; recovery point objective (RPO) 1 hour. The recovery targets that apply to customers under contract are set out in our Service Level Agreement.
Incident Response
In the event of a confirmed data breach affecting Customer Data, Smartta AI will notify affected customers without undue delay and within 72 hours of confirmation, in accordance with our DPA and the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth).
Resold Services
Resold Services (including NoahFace) operate under their own security and compliance programs. We review providers at least yearly; those handling personal data must protect it under written terms. Service-specific terms are detailed in the applicable Resold Service Addendum, incorporated by reference into Order Forms.
AI/ML Transparency
Our AI features provide customers with controls over how their data is used. Service operations data processing is required for platform operation. Aggregated statistics are opt-out. AI/ML model training is strictly opt-in. Details are in our Data Usage Framework.
Shared Responsibility
Smartta AI Manages
- Cloud infrastructure security
- Platform application security
- Data encryption (transit + rest)
- Backups (encrypted snapshots)
- Patch management
Customer Manages
- User credentials and access
- MFA enrolment for their users
- Data accuracy and classification
- Endpoint device security
- Employee consents (e.g. biometric data)