Security | Smart Manager

How we approach security

Smart Manager is operated by SmartManager LLC, a small company. Our founder is our security contact.

We build security into the structure of the product instead of adding it afterwards. The clearest example is data isolation: each account gets its own database.

We label every control on this page by its real status. In place means the system enforces it today or, for a policy, that the policy is written and approved by the owner. Partial means some of it runs today and gaps remain. Planned means it is not yet operating with evidence; each description says what exists.

Your own data store

Most online services keep every customer's data in shared tables and filter rows by account. Smart Manager doesn't. Your workspace data (conversations, memory, documents, email, calendar, contacts and notes) lives in its own database deployment.

A shared control plane holds only what's needed to route requests: account identity, which data store belongs to which account, entitlements, and usage and billing records. It holds no workspace content. File storage is shared, with a separate folder for each account.

This limits the reach of a flaw in one data store to one account. It doesn't protect against a compromise of our own administrative credentials, which is why access to them is tightly restricted.

Control plane

Identity, routing and billing records. No workspace content.

Your data store
Conversations, memory, documents, mail, calendar
Another account
Its own separate database
Another account
Its own separate database

File storage

Shared, with a separate folder for each account.

Each account's workspace data sits in its own database. The control plane routes requests but stores no workspace content.

Encryption

In transit: all traffic to smartmanager.ai uses TLS, and browsers are told to connect over HTTPS only (HSTS).
At rest: file storage is encrypted at rest. Our database provider manages encryption at rest for stored data, and we haven't yet recorded evidence of it for our account.
Connection tokens: the tokens that let us read from services you connect are sealed with AES-256-GCM before they're stored.
Not yet: searchable workspace content has no application-level encryption. Provider encryption protects it on disk, but our own services can read it in order to search and answer. Application-level encryption for searchable data is planned.

Access control

Sign-in runs through our identity provider, WorkOS. Multi-factor authentication is required for administrator accounts and accounts in HIPAA mode, and optional for everyone else.
The server ends inactive sessions: standard sessions after 7 days without activity or 30 days in total, administrator and HIPAA-mode sessions after 15 minutes without activity or 12 hours in total. The web workspace can also lock sooner after inactivity; standard accounts can turn that extra lock off.
Access to production systems is limited to our founder. Every change passes automated checks before release; independent review is expected but not yet enforced.
We don't access your workspace content except to provide support you ask for, to investigate abuse or a security issue, or when the law requires it.

AI providers

Smart Manager uses several AI models, each chosen for a specific job. Every provider is named on our subprocessor list.

No training: we use each provider's business API. Under those terms, providers don't use API data to train their models by default.
Retention: providers may keep API requests for a limited period under their standard terms, for example to detect abuse. We have no zero-data-retention agreements in place. Assisted browsing requests may be retained by OpenAI under its standard API retention; only the text requests on our lighter browsing path are sent with storage turned off. Video generation requests ask Atlas Cloud to delete results after 24 hours.
Memory: the model that updates what Smart Manager remembers about you runs only on OpenAI and never falls back to another provider.
Health information: requests classed as containing health information are blocked by default. Please don't upload protected health information (see compliance status).

Monitoring without your content

Our structured operational logs and traces use a fixed schema that leaves out your content. They record pseudonymous identifiers, route and error labels, and timings.
Browser error logs from signed-in sessions can still capture fragments of what was on screen. We're narrowing them to the same content-free schema.
Analytics and browser diagnostics run only if you allow them, and stay off when your browser sends a Global Privacy Control or Do Not Track signal.
When our firewall blocks or denies a request, our hosting logs record the IP address and browser user agent so we can investigate abuse.
We don't use advertising or social media trackers.

Vulnerability management

Every change runs automated secret scanning and our test suite before it can ship.
Dependencies are audited for known vulnerabilities on every change and weekly, and automated dependency updates are proposed weekly. Our infrastructure itself isn't scanned yet.
No third-party penetration test has been performed yet. We plan one and will update this page when it's done.
Reports from security researchers are welcome; see responsible disclosure.

Incident response

If we become aware of a security incident that affects your personal data, we will:

contain it and investigate what happened;
notify affected customers without undue delay;
where we process data for a business customer as its processor, notify that customer without undue delay and no later than 72 hours after becoming aware of a personal data breach, with the details it needs to meet its own obligations;
notify supervisory authorities within 72 hours where the law requires it for data we control;
keep you informed as we learn more, and share a summary of what we changed afterwards.

Our incident response and breach notification procedures are written but haven't yet been exercised in a drill.

Business continuity

Our hosting, database and storage providers run redundant infrastructure. Our own recovery plan is written, but scheduled database backups and a full restore test aren't in place yet. Our disaster recovery page says exactly what is and isn't covered today.

Compliance status

Certifications: we hold no security or privacy certifications and haven't completed a third-party audit.
GDPR and UK GDPR: we're the controller for personal accounts and a processor for business workspace content. A data processing agreement is available on request. Details are in our Privacy Policy.
US state privacy laws: we don't sell or share personal information, and we honor Global Privacy Control signals.
HIPAA: we're not a covered entity. We would act as a business associate only under a signed business associate agreement (BAA). We don't accept protected health information or sign BAAs today. A BAA will be available on request for eligible customers once our HIPAA mode and our vendors' BAAs are in place. Until then, please don't upload protected health information.

Security controls

This list follows the control areas common to security frameworks. Each control shows where it stands today.

In place: Operating today and enforced by the system or, for a policy, written and approved by the owner.
Partial: Some of it operates today; gaps remain before we would call it complete.
Planned: Not yet operating with evidence. The description says what exists.

Product12

Per-user data isolation
In place
Each account's workspace data lives in its own database deployment, not in rows of a shared table.
Service description communicated
In place
What the service does and its limits are published in our Terms and on this site.
Automatic session locking
In place
The server ends inactive sessions: standard accounts after 7 days idle or 30 days in total, administrator and HIPAA-mode accounts after 15 minutes idle or 12 hours in total. Standard accounts can turn off the extra in-page lock; the server limits still apply.
Data encrypted in transit
In place
All public traffic uses TLS with HSTS preload, and our inbound email service refuses mail that is not sent over TLS.
Data encrypted at rest
Partial
File storage is encrypted at rest, connection tokens are sealed with AES-256-GCM and database keys are stored encrypted. Our database provider's at-rest encryption is not yet recorded, and searchable content has no application-level encryption.
MFA required for applications
Partial
Multi-factor authentication is required for administrator and HIPAA-mode accounts and available to everyone else; ordinary accounts are not required to use it.
Audit logs collected
Partial
A tamper-evident, hash-chained security activity log is built, including requests refused for an expired session, missing MFA or a dormant account; cloud account activity and storage access are logged, but other provider logs are not yet collected in one place.
Dormant accounts disabled
Partial
Code suspends access after 90 days of inactivity, emails the account holder, stops background work and revokes document editing access; its production schedule is not yet switched on.
Company security commitments externally communicated
Partial
This page, our disaster recovery and subprocessor pages and our security.txt state our commitments and their real status.
External support resources available
Partial
A public contact form and these trust pages exist; there is no public help or documentation site yet.
System changes externally communicated
Partial
Changes to legal terms and subprocessors are posted on our legal updates page; there is no product changelog or status page yet.
Changelog established and maintained
Partial
Changes are recorded in version control and an internal change log; there is no public product changelog.

Infrastructure23

Unique production database authentication enforced
In place
Each production database has its own service credential, stored encrypted and loaded per database; the shared control plane has a separate key.
Web Application Firewall (WAF) used
Partial
Rate limiting and abuse protection guard untrusted traffic and a content security policy reports violations; managed firewall rules at our host are not yet decided.
Firewall restricts public access to infrastructure
Partial
Rate limiting protects untrusted entry points but fails open if its key is missing; a network firewall at our host is not yet decided.
Buckets not exposed publicly
In place
Public access is blocked on our production and development storage buckets, and neither has a bucket policy.
Automated backups enabled
Partial
File storage keeps prior versions for 90 days; scheduled database backups are not yet evidenced.
Data recovery process established
Partial
A written restore runbook and restore scripts exist; the per-account database restore path is blocked in testing.
Disaster recovery plans tested
Partial
File and control-plane restore tests passed their integrity checks with gaps; the database restore test is blocked and the tabletop exercise has not been run.
Administrator access restricted
Partial
Platform administrator access needs an allowlisted identity, MFA and a recent sign-in; provider console member lists are not yet attested.
Configuration management system established
Partial
Application, database and job configuration is versioned in our repository; some settings still live only in provider consoles.
Infrastructure deployed using an infrastructure-as-code tool
Partial
Database schemas, per-account data stores, background jobs and hosting configuration deploy from versioned code; cloud storage and DNS are managed in consoles.
Infrastructure changes logged
Partial
Code, schema and data-store releases are recorded in version control and release records, and cloud account activity is logged with integrity validation; audit logs from other provider consoles are not yet exported.
Infrastructure performance monitored
Partial
Health checks and operational monitors run; alerts are logged but nobody is paged yet.
Log management used
Partial
Operational telemetry uses field allowlists that leave out content, and cloud activity and storage access logs are kept with set retention; other provider logs stay in their consoles with no retention set.
Active discovery tools used
Partial
A manual scan finds vendor and configuration signals in our code; it is not yet scheduled or compared against the asset inventory.
Production deployment access restricted
Planned
Release workflows pin the repository, branch, commit and releasing account, but the production environment has no required reviewer yet.
Infrastructure changes require review
Planned
Automated checks gate every release; independent review is expected but not enforced.
Automated security scanning performed on infrastructure
Planned
Code and dependencies are scanned automatically; the infrastructure itself is not yet scanned.
Recovery data isolated
Planned
Prior file versions sit in the same storage account; there is no isolated backup copy yet.
Business continuity and disaster recovery policy established
In place
Written and approved by the owner; the recovery plan has not yet been exercised.
Network infrastructure continuously updated
Planned
Policy approved; network layers are operated by our managed providers, and their responsibility is not yet recorded.
Anti-malware deployed on infrastructure
Planned
Policy approved; we run on managed platforms without self-managed servers, and provider responsibility is not yet recorded.
Unauthorized assets addressed and removed
Planned
Policy written; some retired projects are still being removed.
VPN used
Partial
Policy approved; it records that a VPN does not apply to our managed platforms.

Data and privacy10

Data inventory maintained
Partial
A dated inventory of the personal data we hold, where it lives, why and on what legal basis is maintained; its classifications await owner and legal review.
Data labeled according to classification level
Partial
AI requests carry a data class and account exports are tagged; stored records and logs carry no label yet.
Data management and retention policy established
In place
Policy approved. Retention periods are defined in code and enforced by a daily scheduled sweep, and closed-account cleanup runs on a monthly schedule.
Data-flow diagrams maintained
Partial
Seven data-flow diagrams with code citations, including the audit and privacy flows, are maintained by hand; the owner has not yet reviewed them.
Vendor inventory maintained
Partial
All vendors that process personal data are inventoried (see our subprocessor list); agreement records are not yet attached.
Vendor management program established
Partial
A vendor policy with review and onboarding checklists is approved; no vendor review is complete.
Vendors classified by data sensitivity
Partial
Each vendor has an owner-approved data-class rating and a flag for whether it may receive health information; one recently added browser host is not yet rated.
Vendors classified by risk level
Partial
Each vendor has an owner-approved risk level under our vendor policy; one recently added browser host is not yet rated.
Vendor agreements established
Planned
Vendor data processing agreements are not yet attached to our records, and no business associate agreements are signed.
Access management policy established
In place
Written and approved by the owner.

Internal procedures26

MFA required for administrative access
Partial
In-app administrator controls require MFA and a recent sign-in; MFA for every sign-in method the owner uses is still being configured.
Access revoking process enforced
Partial
Administrators can sign a user out of every device; access to some retired vendors is still being closed.
Account inventory maintained
Partial
An access inventory exists; provider member exports are still being attached.
Vulnerabilities scanned
Partial
Every change gets a dependency audit and secret scan, and a full dependency audit runs weekly; code-scanning results are not yet published and infrastructure is not scanned.
Vulnerability management policy established
In place
Written and approved by the owner, and partly operating through CI checks and a vulnerability register.
Automated software patch management performed
In place
Automated dependency update requests run weekly, and vulnerability alerts with automatic security fixes are switched on.
Adequate audit log storage maintained
Partial
Cloud activity logs are kept for six years and storage access logs for 400 days. The security activity log is designed to be kept for six years and has a monthly retention job that is not yet switched on; retention at other providers is not set.
Risk assessments performed
Partial
A risk register is maintained and the first security risk analysis is approved by the owner; a mobile app addendum and one legal question remain open.
Software development lifecycle established
Partial
Changes pass automated type, lint, test, dependency and secret checks before release; independent review is not enforced.
MFA required for infrastructure access
Planned
An organization-wide two-factor requirement for source control is not yet switched on, and console MFA is not yet attested.
MFA required for critical services
Planned
MFA on each critical provider account is not yet attested.
Access granting process used
Partial
Policy approved; no access grant is recorded yet.
Access requests to sensitive data required
Planned
Policy approved; operator access to customer data has no approval step yet.
Access requests to sensitive infrastructure required
Partial
Policy approved; with a single operator, no request is recorded yet.
Employee access regularly reviewed
Partial
Policy approved; the first access review is due by 2026-12-31.
Password management policy established
In place
Written and approved by the owner.
Password management policy enforced
Planned
Customer passwords are handled by our identity provider; the workforce password manager is not yet recorded.
Change management policy established
In place
Written and approved by the owner.
System changes internally communicated
Partial
Policy approved; no operating record yet.
Incident response policy established
In place
Written and approved by the owner; not yet exercised.
Breach notification process established
Partial
Process approved, including notice timelines; not yet rehearsed.
Incident review process implemented
Partial
Post-incident reviews are part of the approved policy; the first tabletop review has not been run.
Audit log management process maintained
Partial
Policy approved; the first review has not run.
Penetration testing performed within the last 12 months
Planned
No third-party penetration test has been performed yet.
Penetration testing findings remediated
Planned
Will apply once a penetration test is performed.
Risk management policy established
In place
Written and approved by the owner.

Organizational26

DMARC policy and verification used
Partial
DMARC records are published for our domains with aggregate reporting on, in monitoring mode (p=none); they do not yet reject spoofed mail.
Asset inventory maintained
Partial
An asset inventory exists; workforce device entries are pending.
Asset management policy established
In place
Written and approved by the owner; the inventory it governs is maintained.
Security official assigned
In place
The founder is the designated security official; the designation is signed. No backup is named yet.
Policies signed by relevant personnel
In place
All 24 policies are approved and acknowledged by our workforce, which today is the founder.
Acceptable use policy established
In place
Written and approved by the owner.
Code of conduct established
In place
Written and approved by the owner.
Roles and responsibilities specified
In place
Written and approved by the owner.
Security awareness training conducted
Planned
No training is recorded yet.
Onboarding process established
In place
Written and approved by the owner.
Offboarding process established
In place
Written and approved by the owner.
Reference checks performed for employees
Planned
The screening approach will be decided before the first hire.
Performance evaluations conducted
Partial
Policy approved; no review is recorded yet.
Sanction policy established
In place
Written and approved by the owner.
Physical security policy established
In place
Written and approved by the owner; we operate no data centers of our own.
Physical access restricted
Partial
Policy approved; physical hosting security is provided by our cloud providers, and no operating record exists yet.
Workstation use and security policy established
In place
Written and approved by the owner.
Password manager used
Planned
The workforce password manager is not yet recorded.
Automatic session locking enforced
Planned
Screen lock on workforce devices is not yet attested.
Data encrypted on end-user devices
Planned
Full-disk encryption on workforce devices is not yet attested.
Anti-malware deployed on end-user devices
Planned
Malware protection on workforce devices is not yet attested.
Firewall maintained on end-user devices
Planned
Firewall settings on workforce devices are not yet attested.
Mobile device management (MDM) used
Planned
A decision on device management is pending.
Unauthorized software on end-user devices addressed and removed
Planned
A recurring installed-software review is not yet recorded.
Email account access restricted
Planned
Mailbox administrator and MFA settings are not yet attested.
Email settings block malicious content
Planned
Inbound email notifications are signature-verified and inbound mail must arrive over TLS; mailbox filter settings are not yet attested.

Subprocessors

We use a small number of vendors to run Smart Manager. Our subprocessor list names each one, what it does, the data it receives and where it processes data. We post changes there in advance where feasible.

Responsible disclosure

If you find a security vulnerability, email jonathan@smartmanager.ai with the subject "Security report". Include the affected URL or component, steps to reproduce and the impact you observed. Please don't include other people's personal data.

We aim to acknowledge reports within 3 business days and to send an initial assessment within 10 business days. We're a small team, so these are goals, not guarantees.
Test only against accounts you own or have permission to use. Don't access, change or delete data that isn't yours, and don't degrade the service for others. If you reach someone else's data, stop and tell us.
Give us reasonable time to fix the issue before you disclose it publicly. We suggest 90 days.
Safe harbor: if you make a good-faith effort to follow this policy, we consider your research authorized and won't pursue or support legal action against you for it. This covers only systems Smart Manager controls, not third-party services.
There is no bug bounty program. If you'd like credit, we'll credit you once the fix ships.

Our machine-readable security contact is published at /.well-known/security.txt.

Requests

Email jonathan@smartmanager.ai to request:

a data processing agreement (DPA);
a business associate agreement, once available (see compliance status);
answers to a security questionnaire, or more detail on any control on this page.

How we approach security

Smart Manager is operated by SmartManager LLC, a small company. Our founder is our security contact.

We build security into the structure of the product instead of adding it afterwards. The clearest example is data isolation: each account gets its own database.

Your own data store

This limits the reach of a flaw in one data store to one account. It doesn't protect against a compromise of our own administrative credentials, which is why access to them is tightly restricted.

Control plane

Identity, routing and billing records. No workspace content.

Your data store
Conversations, memory, documents, mail, calendar
Another account
Its own separate database
Another account
Its own separate database

File storage

Shared, with a separate folder for each account.

Each account's workspace data sits in its own database. The control plane routes requests but stores no workspace content.

Encryption

In transit: all traffic to smartmanager.ai uses TLS, and browsers are told to connect over HTTPS only (HSTS).
At rest: file storage is encrypted at rest. Our database provider manages encryption at rest for stored data, and we haven't yet recorded evidence of it for our account.
Connection tokens: the tokens that let us read from services you connect are sealed with AES-256-GCM before they're stored.
Not yet: searchable workspace content has no application-level encryption. Provider encryption protects it on disk, but our own services can read it in order to search and answer. Application-level encryption for searchable data is planned.

Access control

Sign-in runs through our identity provider, WorkOS. Multi-factor authentication is required for administrator accounts and accounts in HIPAA mode, and optional for everyone else.
The server ends inactive sessions: standard sessions after 7 days without activity or 30 days in total, administrator and HIPAA-mode sessions after 15 minutes without activity or 12 hours in total. The web workspace can also lock sooner after inactivity; standard accounts can turn that extra lock off.
Access to production systems is limited to our founder. Every change passes automated checks before release; independent review is expected but not yet enforced.
We don't access your workspace content except to provide support you ask for, to investigate abuse or a security issue, or when the law requires it.

AI providers

Smart Manager uses several AI models, each chosen for a specific job. Every provider is named on our subprocessor list.

No training: we use each provider's business API. Under those terms, providers don't use API data to train their models by default.
Retention: providers may keep API requests for a limited period under their standard terms, for example to detect abuse. We have no zero-data-retention agreements in place. Assisted browsing requests may be retained by OpenAI under its standard API retention; only the text requests on our lighter browsing path are sent with storage turned off. Video generation requests ask Atlas Cloud to delete results after 24 hours.
Memory: the model that updates what Smart Manager remembers about you runs only on OpenAI and never falls back to another provider.
Health information: requests classed as containing health information are blocked by default. Please don't upload protected health information (see compliance status).

Monitoring without your content

Our structured operational logs and traces use a fixed schema that leaves out your content. They record pseudonymous identifiers, route and error labels, and timings.
Browser error logs from signed-in sessions can still capture fragments of what was on screen. We're narrowing them to the same content-free schema.
Analytics and browser diagnostics run only if you allow them, and stay off when your browser sends a Global Privacy Control or Do Not Track signal.
When our firewall blocks or denies a request, our hosting logs record the IP address and browser user agent so we can investigate abuse.
We don't use advertising or social media trackers.

Vulnerability management

Every change runs automated secret scanning and our test suite before it can ship.
Dependencies are audited for known vulnerabilities on every change and weekly, and automated dependency updates are proposed weekly. Our infrastructure itself isn't scanned yet.
No third-party penetration test has been performed yet. We plan one and will update this page when it's done.
Reports from security researchers are welcome; see responsible disclosure.

Incident response

If we become aware of a security incident that affects your personal data, we will:

contain it and investigate what happened;
notify affected customers without undue delay;
where we process data for a business customer as its processor, notify that customer without undue delay and no later than 72 hours after becoming aware of a personal data breach, with the details it needs to meet its own obligations;
notify supervisory authorities within 72 hours where the law requires it for data we control;
keep you informed as we learn more, and share a summary of what we changed afterwards.

Our incident response and breach notification procedures are written but haven't yet been exercised in a drill.

Business continuity

Compliance status

Certifications: we hold no security or privacy certifications and haven't completed a third-party audit.
GDPR and UK GDPR: we're the controller for personal accounts and a processor for business workspace content. A data processing agreement is available on request. Details are in our Privacy Policy.
US state privacy laws: we don't sell or share personal information, and we honor Global Privacy Control signals.
HIPAA: we're not a covered entity. We would act as a business associate only under a signed business associate agreement (BAA). We don't accept protected health information or sign BAAs today. A BAA will be available on request for eligible customers once our HIPAA mode and our vendors' BAAs are in place. Until then, please don't upload protected health information.

Security controls

This list follows the control areas common to security frameworks. Each control shows where it stands today.

In place: Operating today and enforced by the system or, for a policy, written and approved by the owner.
Partial: Some of it operates today; gaps remain before we would call it complete.
Planned: Not yet operating with evidence. The description says what exists.

Product12

Per-user data isolation
In place
Each account's workspace data lives in its own database deployment, not in rows of a shared table.
Service description communicated
In place
What the service does and its limits are published in our Terms and on this site.
Automatic session locking
In place
The server ends inactive sessions: standard accounts after 7 days idle or 30 days in total, administrator and HIPAA-mode accounts after 15 minutes idle or 12 hours in total. Standard accounts can turn off the extra in-page lock; the server limits still apply.
Data encrypted in transit
In place
All public traffic uses TLS with HSTS preload, and our inbound email service refuses mail that is not sent over TLS.
Data encrypted at rest
Partial
File storage is encrypted at rest, connection tokens are sealed with AES-256-GCM and database keys are stored encrypted. Our database provider's at-rest encryption is not yet recorded, and searchable content has no application-level encryption.
MFA required for applications
Partial
Multi-factor authentication is required for administrator and HIPAA-mode accounts and available to everyone else; ordinary accounts are not required to use it.
Audit logs collected
Partial
A tamper-evident, hash-chained security activity log is built, including requests refused for an expired session, missing MFA or a dormant account; cloud account activity and storage access are logged, but other provider logs are not yet collected in one place.
Dormant accounts disabled
Partial
Code suspends access after 90 days of inactivity, emails the account holder, stops background work and revokes document editing access; its production schedule is not yet switched on.
Company security commitments externally communicated
Partial
This page, our disaster recovery and subprocessor pages and our security.txt state our commitments and their real status.
External support resources available
Partial
A public contact form and these trust pages exist; there is no public help or documentation site yet.
System changes externally communicated
Partial
Changes to legal terms and subprocessors are posted on our legal updates page; there is no product changelog or status page yet.
Changelog established and maintained
Partial
Changes are recorded in version control and an internal change log; there is no public product changelog.

Infrastructure23

Unique production database authentication enforced
In place
Each production database has its own service credential, stored encrypted and loaded per database; the shared control plane has a separate key.
Web Application Firewall (WAF) used
Partial
Rate limiting and abuse protection guard untrusted traffic and a content security policy reports violations; managed firewall rules at our host are not yet decided.
Firewall restricts public access to infrastructure
Partial
Rate limiting protects untrusted entry points but fails open if its key is missing; a network firewall at our host is not yet decided.
Buckets not exposed publicly
In place
Public access is blocked on our production and development storage buckets, and neither has a bucket policy.
Automated backups enabled
Partial
File storage keeps prior versions for 90 days; scheduled database backups are not yet evidenced.
Data recovery process established
Partial
A written restore runbook and restore scripts exist; the per-account database restore path is blocked in testing.
Disaster recovery plans tested
Partial
File and control-plane restore tests passed their integrity checks with gaps; the database restore test is blocked and the tabletop exercise has not been run.
Administrator access restricted
Partial
Platform administrator access needs an allowlisted identity, MFA and a recent sign-in; provider console member lists are not yet attested.
Configuration management system established
Partial
Application, database and job configuration is versioned in our repository; some settings still live only in provider consoles.
Infrastructure deployed using an infrastructure-as-code tool
Partial
Database schemas, per-account data stores, background jobs and hosting configuration deploy from versioned code; cloud storage and DNS are managed in consoles.
Infrastructure changes logged
Partial
Code, schema and data-store releases are recorded in version control and release records, and cloud account activity is logged with integrity validation; audit logs from other provider consoles are not yet exported.
Infrastructure performance monitored
Partial
Health checks and operational monitors run; alerts are logged but nobody is paged yet.
Log management used
Partial
Operational telemetry uses field allowlists that leave out content, and cloud activity and storage access logs are kept with set retention; other provider logs stay in their consoles with no retention set.
Active discovery tools used
Partial
A manual scan finds vendor and configuration signals in our code; it is not yet scheduled or compared against the asset inventory.
Production deployment access restricted
Planned
Release workflows pin the repository, branch, commit and releasing account, but the production environment has no required reviewer yet.
Infrastructure changes require review
Planned
Automated checks gate every release; independent review is expected but not enforced.
Automated security scanning performed on infrastructure
Planned
Code and dependencies are scanned automatically; the infrastructure itself is not yet scanned.
Recovery data isolated
Planned
Prior file versions sit in the same storage account; there is no isolated backup copy yet.
Business continuity and disaster recovery policy established
In place
Written and approved by the owner; the recovery plan has not yet been exercised.
Network infrastructure continuously updated
Planned
Policy approved; network layers are operated by our managed providers, and their responsibility is not yet recorded.
Anti-malware deployed on infrastructure
Planned
Policy approved; we run on managed platforms without self-managed servers, and provider responsibility is not yet recorded.
Unauthorized assets addressed and removed
Planned
Policy written; some retired projects are still being removed.
VPN used
Partial
Policy approved; it records that a VPN does not apply to our managed platforms.

Data and privacy10

Data inventory maintained
Partial
A dated inventory of the personal data we hold, where it lives, why and on what legal basis is maintained; its classifications await owner and legal review.
Data labeled according to classification level
Partial
AI requests carry a data class and account exports are tagged; stored records and logs carry no label yet.
Data management and retention policy established
In place
Policy approved. Retention periods are defined in code and enforced by a daily scheduled sweep, and closed-account cleanup runs on a monthly schedule.
Data-flow diagrams maintained
Partial
Seven data-flow diagrams with code citations, including the audit and privacy flows, are maintained by hand; the owner has not yet reviewed them.
Vendor inventory maintained
Partial
All vendors that process personal data are inventoried (see our subprocessor list); agreement records are not yet attached.
Vendor management program established
Partial
A vendor policy with review and onboarding checklists is approved; no vendor review is complete.
Vendors classified by data sensitivity
Partial
Each vendor has an owner-approved data-class rating and a flag for whether it may receive health information; one recently added browser host is not yet rated.
Vendors classified by risk level
Partial
Each vendor has an owner-approved risk level under our vendor policy; one recently added browser host is not yet rated.
Vendor agreements established
Planned
Vendor data processing agreements are not yet attached to our records, and no business associate agreements are signed.
Access management policy established
In place
Written and approved by the owner.

Internal procedures26

MFA required for administrative access
Partial
In-app administrator controls require MFA and a recent sign-in; MFA for every sign-in method the owner uses is still being configured.
Access revoking process enforced
Partial
Administrators can sign a user out of every device; access to some retired vendors is still being closed.
Account inventory maintained
Partial
An access inventory exists; provider member exports are still being attached.
Vulnerabilities scanned
Partial
Every change gets a dependency audit and secret scan, and a full dependency audit runs weekly; code-scanning results are not yet published and infrastructure is not scanned.
Vulnerability management policy established
In place
Written and approved by the owner, and partly operating through CI checks and a vulnerability register.
Automated software patch management performed
In place
Automated dependency update requests run weekly, and vulnerability alerts with automatic security fixes are switched on.
Adequate audit log storage maintained
Partial
Cloud activity logs are kept for six years and storage access logs for 400 days. The security activity log is designed to be kept for six years and has a monthly retention job that is not yet switched on; retention at other providers is not set.
Risk assessments performed
Partial
A risk register is maintained and the first security risk analysis is approved by the owner; a mobile app addendum and one legal question remain open.
Software development lifecycle established
Partial
Changes pass automated type, lint, test, dependency and secret checks before release; independent review is not enforced.
MFA required for infrastructure access
Planned
An organization-wide two-factor requirement for source control is not yet switched on, and console MFA is not yet attested.
MFA required for critical services
Planned
MFA on each critical provider account is not yet attested.
Access granting process used
Partial
Policy approved; no access grant is recorded yet.
Access requests to sensitive data required
Planned
Policy approved; operator access to customer data has no approval step yet.
Access requests to sensitive infrastructure required
Partial
Policy approved; with a single operator, no request is recorded yet.
Employee access regularly reviewed
Partial
Policy approved; the first access review is due by 2026-12-31.
Password management policy established
In place
Written and approved by the owner.
Password management policy enforced
Planned
Customer passwords are handled by our identity provider; the workforce password manager is not yet recorded.
Change management policy established
In place
Written and approved by the owner.
System changes internally communicated
Partial
Policy approved; no operating record yet.
Incident response policy established
In place
Written and approved by the owner; not yet exercised.
Breach notification process established
Partial
Process approved, including notice timelines; not yet rehearsed.
Incident review process implemented
Partial
Post-incident reviews are part of the approved policy; the first tabletop review has not been run.
Audit log management process maintained
Partial
Policy approved; the first review has not run.
Penetration testing performed within the last 12 months
Planned
No third-party penetration test has been performed yet.
Penetration testing findings remediated
Planned
Will apply once a penetration test is performed.
Risk management policy established
In place
Written and approved by the owner.

Organizational26

DMARC policy and verification used
Partial
DMARC records are published for our domains with aggregate reporting on, in monitoring mode (p=none); they do not yet reject spoofed mail.
Asset inventory maintained
Partial
An asset inventory exists; workforce device entries are pending.
Asset management policy established
In place
Written and approved by the owner; the inventory it governs is maintained.
Security official assigned
In place
The founder is the designated security official; the designation is signed. No backup is named yet.
Policies signed by relevant personnel
In place
All 24 policies are approved and acknowledged by our workforce, which today is the founder.
Acceptable use policy established
In place
Written and approved by the owner.
Code of conduct established
In place
Written and approved by the owner.
Roles and responsibilities specified
In place
Written and approved by the owner.
Security awareness training conducted
Planned
No training is recorded yet.
Onboarding process established
In place
Written and approved by the owner.
Offboarding process established
In place
Written and approved by the owner.
Reference checks performed for employees
Planned
The screening approach will be decided before the first hire.
Performance evaluations conducted
Partial
Policy approved; no review is recorded yet.
Sanction policy established
In place
Written and approved by the owner.
Physical security policy established
In place
Written and approved by the owner; we operate no data centers of our own.
Physical access restricted
Partial
Policy approved; physical hosting security is provided by our cloud providers, and no operating record exists yet.
Workstation use and security policy established
In place
Written and approved by the owner.
Password manager used
Planned
The workforce password manager is not yet recorded.
Automatic session locking enforced
Planned
Screen lock on workforce devices is not yet attested.
Data encrypted on end-user devices
Planned
Full-disk encryption on workforce devices is not yet attested.
Anti-malware deployed on end-user devices
Planned
Malware protection on workforce devices is not yet attested.
Firewall maintained on end-user devices
Planned
Firewall settings on workforce devices are not yet attested.
Mobile device management (MDM) used
Planned
A decision on device management is pending.
Unauthorized software on end-user devices addressed and removed
Planned
A recurring installed-software review is not yet recorded.
Email account access restricted
Planned
Mailbox administrator and MFA settings are not yet attested.
Email settings block malicious content
Planned
Inbound email notifications are signature-verified and inbound mail must arrive over TLS; mailbox filter settings are not yet attested.

Subprocessors

Responsible disclosure

We aim to acknowledge reports within 3 business days and to send an initial assessment within 10 business days. We're a small team, so these are goals, not guarantees.
Test only against accounts you own or have permission to use. Don't access, change or delete data that isn't yours, and don't degrade the service for others. If you reach someone else's data, stop and tell us.
Give us reasonable time to fix the issue before you disclose it publicly. We suggest 90 days.
Safe harbor: if you make a good-faith effort to follow this policy, we consider your research authorized and won't pursue or support legal action against you for it. This covers only systems Smart Manager controls, not third-party services.
There is no bug bounty program. If you'd like credit, we'll credit you once the fix ships.

Our machine-readable security contact is published at /.well-known/security.txt.

Requests

Email jonathan@smartmanager.ai to request:

a data processing agreement (DPA);
a business associate agreement, once available (see compliance status);
answers to a security questionnaire, or more detail on any control on this page.

How we approach security

Smart Manager is operated by SmartManager LLC, a small company. Our founder is our security contact.

We build security into the structure of the product instead of adding it afterwards. The clearest example is data isolation: each account gets its own database.

Your own data store

This limits the reach of a flaw in one data store to one account. It doesn't protect against a compromise of our own administrative credentials, which is why access to them is tightly restricted.

Control plane

Identity, routing and billing records. No workspace content.

Your data store
Conversations, memory, documents, mail, calendar
Another account
Its own separate database
Another account
Its own separate database

File storage

Shared, with a separate folder for each account.

Each account's workspace data sits in its own database. The control plane routes requests but stores no workspace content.

Encryption

In transit: all traffic to smartmanager.ai uses TLS, and browsers are told to connect over HTTPS only (HSTS).
At rest: file storage is encrypted at rest. Our database provider manages encryption at rest for stored data, and we haven't yet recorded evidence of it for our account.
Connection tokens: the tokens that let us read from services you connect are sealed with AES-256-GCM before they're stored.
Not yet: searchable workspace content has no application-level encryption. Provider encryption protects it on disk, but our own services can read it in order to search and answer. Application-level encryption for searchable data is planned.

Access control

Sign-in runs through our identity provider, WorkOS. Multi-factor authentication is required for administrator accounts and accounts in HIPAA mode, and optional for everyone else.
The server ends inactive sessions: standard sessions after 7 days without activity or 30 days in total, administrator and HIPAA-mode sessions after 15 minutes without activity or 12 hours in total. The web workspace can also lock sooner after inactivity; standard accounts can turn that extra lock off.
Access to production systems is limited to our founder. Every change passes automated checks before release; independent review is expected but not yet enforced.
We don't access your workspace content except to provide support you ask for, to investigate abuse or a security issue, or when the law requires it.

AI providers

Smart Manager uses several AI models, each chosen for a specific job. Every provider is named on our subprocessor list.

No training: we use each provider's business API. Under those terms, providers don't use API data to train their models by default.
Retention: providers may keep API requests for a limited period under their standard terms, for example to detect abuse. We have no zero-data-retention agreements in place. Assisted browsing requests may be retained by OpenAI under its standard API retention; only the text requests on our lighter browsing path are sent with storage turned off. Video generation requests ask Atlas Cloud to delete results after 24 hours.
Memory: the model that updates what Smart Manager remembers about you runs only on OpenAI and never falls back to another provider.
Health information: requests classed as containing health information are blocked by default. Please don't upload protected health information (see compliance status).

Monitoring without your content

Our structured operational logs and traces use a fixed schema that leaves out your content. They record pseudonymous identifiers, route and error labels, and timings.
Browser error logs from signed-in sessions can still capture fragments of what was on screen. We're narrowing them to the same content-free schema.
Analytics and browser diagnostics run only if you allow them, and stay off when your browser sends a Global Privacy Control or Do Not Track signal.
When our firewall blocks or denies a request, our hosting logs record the IP address and browser user agent so we can investigate abuse.
We don't use advertising or social media trackers.

Vulnerability management

Every change runs automated secret scanning and our test suite before it can ship.
Dependencies are audited for known vulnerabilities on every change and weekly, and automated dependency updates are proposed weekly. Our infrastructure itself isn't scanned yet.
No third-party penetration test has been performed yet. We plan one and will update this page when it's done.
Reports from security researchers are welcome; see responsible disclosure.

Incident response

If we become aware of a security incident that affects your personal data, we will:

contain it and investigate what happened;
notify affected customers without undue delay;
where we process data for a business customer as its processor, notify that customer without undue delay and no later than 72 hours after becoming aware of a personal data breach, with the details it needs to meet its own obligations;
notify supervisory authorities within 72 hours where the law requires it for data we control;
keep you informed as we learn more, and share a summary of what we changed afterwards.

Our incident response and breach notification procedures are written but haven't yet been exercised in a drill.

Business continuity

Compliance status

Certifications: we hold no security or privacy certifications and haven't completed a third-party audit.
GDPR and UK GDPR: we're the controller for personal accounts and a processor for business workspace content. A data processing agreement is available on request. Details are in our Privacy Policy.
US state privacy laws: we don't sell or share personal information, and we honor Global Privacy Control signals.
HIPAA: we're not a covered entity. We would act as a business associate only under a signed business associate agreement (BAA). We don't accept protected health information or sign BAAs today. A BAA will be available on request for eligible customers once our HIPAA mode and our vendors' BAAs are in place. Until then, please don't upload protected health information.

Security controls

This list follows the control areas common to security frameworks. Each control shows where it stands today.

In place: Operating today and enforced by the system or, for a policy, written and approved by the owner.
Partial: Some of it operates today; gaps remain before we would call it complete.
Planned: Not yet operating with evidence. The description says what exists.

Product12

Per-user data isolation
In place
Each account's workspace data lives in its own database deployment, not in rows of a shared table.
Service description communicated
In place
What the service does and its limits are published in our Terms and on this site.
Automatic session locking
In place
The server ends inactive sessions: standard accounts after 7 days idle or 30 days in total, administrator and HIPAA-mode accounts after 15 minutes idle or 12 hours in total. Standard accounts can turn off the extra in-page lock; the server limits still apply.
Data encrypted in transit
In place
All public traffic uses TLS with HSTS preload, and our inbound email service refuses mail that is not sent over TLS.
Data encrypted at rest
Partial
File storage is encrypted at rest, connection tokens are sealed with AES-256-GCM and database keys are stored encrypted. Our database provider's at-rest encryption is not yet recorded, and searchable content has no application-level encryption.
MFA required for applications
Partial
Multi-factor authentication is required for administrator and HIPAA-mode accounts and available to everyone else; ordinary accounts are not required to use it.
Audit logs collected
Partial
A tamper-evident, hash-chained security activity log is built, including requests refused for an expired session, missing MFA or a dormant account; cloud account activity and storage access are logged, but other provider logs are not yet collected in one place.
Dormant accounts disabled
Partial
Code suspends access after 90 days of inactivity, emails the account holder, stops background work and revokes document editing access; its production schedule is not yet switched on.
Company security commitments externally communicated
Partial
This page, our disaster recovery and subprocessor pages and our security.txt state our commitments and their real status.
External support resources available
Partial
A public contact form and these trust pages exist; there is no public help or documentation site yet.
System changes externally communicated
Partial
Changes to legal terms and subprocessors are posted on our legal updates page; there is no product changelog or status page yet.
Changelog established and maintained
Partial
Changes are recorded in version control and an internal change log; there is no public product changelog.

Infrastructure23

Unique production database authentication enforced
In place
Each production database has its own service credential, stored encrypted and loaded per database; the shared control plane has a separate key.
Web Application Firewall (WAF) used
Partial
Rate limiting and abuse protection guard untrusted traffic and a content security policy reports violations; managed firewall rules at our host are not yet decided.
Firewall restricts public access to infrastructure
Partial
Rate limiting protects untrusted entry points but fails open if its key is missing; a network firewall at our host is not yet decided.
Buckets not exposed publicly
In place
Public access is blocked on our production and development storage buckets, and neither has a bucket policy.
Automated backups enabled
Partial
File storage keeps prior versions for 90 days; scheduled database backups are not yet evidenced.
Data recovery process established
Partial
A written restore runbook and restore scripts exist; the per-account database restore path is blocked in testing.
Disaster recovery plans tested
Partial
File and control-plane restore tests passed their integrity checks with gaps; the database restore test is blocked and the tabletop exercise has not been run.
Administrator access restricted
Partial
Platform administrator access needs an allowlisted identity, MFA and a recent sign-in; provider console member lists are not yet attested.
Configuration management system established
Partial
Application, database and job configuration is versioned in our repository; some settings still live only in provider consoles.
Infrastructure deployed using an infrastructure-as-code tool
Partial
Database schemas, per-account data stores, background jobs and hosting configuration deploy from versioned code; cloud storage and DNS are managed in consoles.
Infrastructure changes logged
Partial
Code, schema and data-store releases are recorded in version control and release records, and cloud account activity is logged with integrity validation; audit logs from other provider consoles are not yet exported.
Infrastructure performance monitored
Partial
Health checks and operational monitors run; alerts are logged but nobody is paged yet.
Log management used
Partial
Operational telemetry uses field allowlists that leave out content, and cloud activity and storage access logs are kept with set retention; other provider logs stay in their consoles with no retention set.
Active discovery tools used
Partial
A manual scan finds vendor and configuration signals in our code; it is not yet scheduled or compared against the asset inventory.
Production deployment access restricted
Planned
Release workflows pin the repository, branch, commit and releasing account, but the production environment has no required reviewer yet.
Infrastructure changes require review
Planned
Automated checks gate every release; independent review is expected but not enforced.
Automated security scanning performed on infrastructure
Planned
Code and dependencies are scanned automatically; the infrastructure itself is not yet scanned.
Recovery data isolated
Planned
Prior file versions sit in the same storage account; there is no isolated backup copy yet.
Business continuity and disaster recovery policy established
In place
Written and approved by the owner; the recovery plan has not yet been exercised.
Network infrastructure continuously updated
Planned
Policy approved; network layers are operated by our managed providers, and their responsibility is not yet recorded.
Anti-malware deployed on infrastructure
Planned
Policy approved; we run on managed platforms without self-managed servers, and provider responsibility is not yet recorded.
Unauthorized assets addressed and removed
Planned
Policy written; some retired projects are still being removed.
VPN used
Partial
Policy approved; it records that a VPN does not apply to our managed platforms.

Data and privacy10

Data inventory maintained
Partial
A dated inventory of the personal data we hold, where it lives, why and on what legal basis is maintained; its classifications await owner and legal review.
Data labeled according to classification level
Partial
AI requests carry a data class and account exports are tagged; stored records and logs carry no label yet.
Data management and retention policy established
In place
Policy approved. Retention periods are defined in code and enforced by a daily scheduled sweep, and closed-account cleanup runs on a monthly schedule.
Data-flow diagrams maintained
Partial
Seven data-flow diagrams with code citations, including the audit and privacy flows, are maintained by hand; the owner has not yet reviewed them.
Vendor inventory maintained
Partial
All vendors that process personal data are inventoried (see our subprocessor list); agreement records are not yet attached.
Vendor management program established
Partial
A vendor policy with review and onboarding checklists is approved; no vendor review is complete.
Vendors classified by data sensitivity
Partial
Each vendor has an owner-approved data-class rating and a flag for whether it may receive health information; one recently added browser host is not yet rated.
Vendors classified by risk level
Partial
Each vendor has an owner-approved risk level under our vendor policy; one recently added browser host is not yet rated.
Vendor agreements established
Planned
Vendor data processing agreements are not yet attached to our records, and no business associate agreements are signed.
Access management policy established
In place
Written and approved by the owner.

Internal procedures26

MFA required for administrative access
Partial
In-app administrator controls require MFA and a recent sign-in; MFA for every sign-in method the owner uses is still being configured.
Access revoking process enforced
Partial
Administrators can sign a user out of every device; access to some retired vendors is still being closed.
Account inventory maintained
Partial
An access inventory exists; provider member exports are still being attached.
Vulnerabilities scanned
Partial
Every change gets a dependency audit and secret scan, and a full dependency audit runs weekly; code-scanning results are not yet published and infrastructure is not scanned.
Vulnerability management policy established
In place
Written and approved by the owner, and partly operating through CI checks and a vulnerability register.
Automated software patch management performed
In place
Automated dependency update requests run weekly, and vulnerability alerts with automatic security fixes are switched on.
Adequate audit log storage maintained
Partial
Cloud activity logs are kept for six years and storage access logs for 400 days. The security activity log is designed to be kept for six years and has a monthly retention job that is not yet switched on; retention at other providers is not set.
Risk assessments performed
Partial
A risk register is maintained and the first security risk analysis is approved by the owner; a mobile app addendum and one legal question remain open.
Software development lifecycle established
Partial
Changes pass automated type, lint, test, dependency and secret checks before release; independent review is not enforced.
MFA required for infrastructure access
Planned
An organization-wide two-factor requirement for source control is not yet switched on, and console MFA is not yet attested.
MFA required for critical services
Planned
MFA on each critical provider account is not yet attested.
Access granting process used
Partial
Policy approved; no access grant is recorded yet.
Access requests to sensitive data required
Planned
Policy approved; operator access to customer data has no approval step yet.
Access requests to sensitive infrastructure required
Partial
Policy approved; with a single operator, no request is recorded yet.
Employee access regularly reviewed
Partial
Policy approved; the first access review is due by 2026-12-31.
Password management policy established
In place
Written and approved by the owner.
Password management policy enforced
Planned
Customer passwords are handled by our identity provider; the workforce password manager is not yet recorded.
Change management policy established
In place
Written and approved by the owner.
System changes internally communicated
Partial
Policy approved; no operating record yet.
Incident response policy established
In place
Written and approved by the owner; not yet exercised.
Breach notification process established
Partial
Process approved, including notice timelines; not yet rehearsed.
Incident review process implemented
Partial
Post-incident reviews are part of the approved policy; the first tabletop review has not been run.
Audit log management process maintained
Partial
Policy approved; the first review has not run.
Penetration testing performed within the last 12 months
Planned
No third-party penetration test has been performed yet.
Penetration testing findings remediated
Planned
Will apply once a penetration test is performed.
Risk management policy established
In place
Written and approved by the owner.

Organizational26

DMARC policy and verification used
Partial
DMARC records are published for our domains with aggregate reporting on, in monitoring mode (p=none); they do not yet reject spoofed mail.
Asset inventory maintained
Partial
An asset inventory exists; workforce device entries are pending.
Asset management policy established
In place
Written and approved by the owner; the inventory it governs is maintained.
Security official assigned
In place
The founder is the designated security official; the designation is signed. No backup is named yet.
Policies signed by relevant personnel
In place
All 24 policies are approved and acknowledged by our workforce, which today is the founder.
Acceptable use policy established
In place
Written and approved by the owner.
Code of conduct established
In place
Written and approved by the owner.
Roles and responsibilities specified
In place
Written and approved by the owner.
Security awareness training conducted
Planned
No training is recorded yet.
Onboarding process established
In place
Written and approved by the owner.
Offboarding process established
In place
Written and approved by the owner.
Reference checks performed for employees
Planned
The screening approach will be decided before the first hire.
Performance evaluations conducted
Partial
Policy approved; no review is recorded yet.
Sanction policy established
In place
Written and approved by the owner.
Physical security policy established
In place
Written and approved by the owner; we operate no data centers of our own.
Physical access restricted
Partial
Policy approved; physical hosting security is provided by our cloud providers, and no operating record exists yet.
Workstation use and security policy established
In place
Written and approved by the owner.
Password manager used
Planned
The workforce password manager is not yet recorded.
Automatic session locking enforced
Planned
Screen lock on workforce devices is not yet attested.
Data encrypted on end-user devices
Planned
Full-disk encryption on workforce devices is not yet attested.
Anti-malware deployed on end-user devices
Planned
Malware protection on workforce devices is not yet attested.
Firewall maintained on end-user devices
Planned
Firewall settings on workforce devices are not yet attested.
Mobile device management (MDM) used
Planned
A decision on device management is pending.
Unauthorized software on end-user devices addressed and removed
Planned
A recurring installed-software review is not yet recorded.
Email account access restricted
Planned
Mailbox administrator and MFA settings are not yet attested.
Email settings block malicious content
Planned
Inbound email notifications are signature-verified and inbound mail must arrive over TLS; mailbox filter settings are not yet attested.

Subprocessors

Responsible disclosure

We aim to acknowledge reports within 3 business days and to send an initial assessment within 10 business days. We're a small team, so these are goals, not guarantees.
Test only against accounts you own or have permission to use. Don't access, change or delete data that isn't yours, and don't degrade the service for others. If you reach someone else's data, stop and tell us.
Give us reasonable time to fix the issue before you disclose it publicly. We suggest 90 days.
Safe harbor: if you make a good-faith effort to follow this policy, we consider your research authorized and won't pursue or support legal action against you for it. This covers only systems Smart Manager controls, not third-party services.
There is no bug bounty program. If you'd like credit, we'll credit you once the fix ships.

Our machine-readable security contact is published at /.well-known/security.txt.

Requests

Email jonathan@smartmanager.ai to request:

a data processing agreement (DPA);
a business associate agreement, once available (see compliance status);
answers to a security questionnaire, or more detail on any control on this page.