EU · UK
GDPR
We respond within one month, extendable by two months for complex requests as GDPR allows.
Trust Portal
Trust & Security
At Smartreview AI, security, privacy, compliance and transparency come first. Buyers rely on our Trust-IQ Score™ to evaluate software vendors, so we hold our own platform to the same standard.
This portal explains how we protect your information, where each framework stands, and what changes as our programs mature.
Privacy
Privacy by design. We collect only what the service needs, do not sell or share personal information, and honor GDPR and CPRA rights.
Security
Encryption in transit and at rest, role-based access, multi-factor authentication and monitoring across the platform.
Compliance
Compliant with GDPR and CPRA today. ISO/IEC 27001 and SOC 2 programs are in progress.
Responsible AI
Our AI scoring is explainable. The Trust-IQ Score™ arithmetic is published, and every point traces back to a verified review or tested evidence.
Privacy rights
You control your personal data
- AccessGet a copy of the personal data we hold about you.
- CorrectionFix data that is inaccurate or incomplete.
- DeletionAsk us to erase your data, subject to legal retention.
- PortabilityReceive your data in a machine-readable format.
- Objection and restrictionLimit how we process your data.
- Opt out of sale or sharingWe do not sell or share data. The right still stands.
- Limit sensitive data useRestrict use of sensitive personal information.
- No discriminationUsing a right never changes your service.
CALIFORNIA
CPRA
We respond within 45 days, extendable by a further 45 days where the law allows.
Make a request
Email privacy@smartreviewai.io with the right you want to use. We verify your identity, then act.
Privacy policy
Security
Security controls
EncryptionEnforced
In transit and at rest
TLS 1.2+ on all traffic, AES-256 for databases, files and backups, and keys held in a secrets manager, never in source code.
Access controlEnforced
Least privilege · multi-factor authentication
Role-based access enforced at the database layer, tenant isolation between partners, and MFA on every administrative account.
Monitoring and recoveryActive
Logging, alerting and backups
Application, error and access logs with alerts on anomalous activity, plus encrypted backups with point-in-time recovery.
Secure developmentIn place
Software development lifecycle
Code review on every change, automated dependency and secrets scanning, and separate development and production environments.
Data protection
Your data is protected.
Your browser
Reviews, evidence uploads, sign-in
TLS 1.2+HSTS enforced
Smartreview AI
Role-based access, tenant isolation
AES-256Managed keys
Encrypted storage
Databases, files and backups
IN TRANSIT
TLS 1.2+
HTTP redirected to HTTPS
AT REST
AES-256
Data, files, backups
SECRETS
Secrets manager
Never in source code
PASSWORDS
Salted hashing
Unrecoverable by us
Infrastructure
Infrastructure and operations
Certified hosting
Built on SOC 2-audited cloud infrastructure
YouBrowser or API
Smartreview AI trust boundary
Layer 1Edge
Filters hostile traffic
- DDoS mitigation
- Rate limits
- Bot checks
Layer 2Application
Controls who can do what
- RBAC
- Tenant isolation
- MFA
Layer 3Data
Protects what is stored
- AES-256 encryption
- Encrypted backups
- BCP / DR plan
Cloud hosting providerPhysical, network and environmental controlsSOC 2ISO/IEC 27001
Backups and recovery
Automated, encrypted backups with point-in-time recovery, tested by restoring to a non-production environment.
Monitoring
Application, error and access logs with alerts on anomalous activity. Log access is restricted.
Access to your data
Only named personnel with a business need reach production, and every admin account uses multi-factor authentication.
Edge protection
DDoS mitigation and rate limiting at the network edge, with bot protection on review submission and sign-up.
Subprocessors
Each subprocessor is assessed before onboarding and bound by a data processing agreement.
Responsible disclosure
Report a vulnerability
Found a security issue? Tell us first and give us reasonable time to fix it before sharing it anywhere else.
Bug bounty and vulnerability reports
security@smartreviewai.io
- Subject line Bug bounty
- Affected URL or endpoint
- Steps to reproduce
Compliance
Certifications and frameworks
GDPRCompliant
Regulation (EU) 2016/679 and UK GDPR
Lawful basis recorded for each processing activity, data processing agreements with every subprocessor, and data subject requests answered within one month.
CPRACompliant
California Privacy Rights Act
We do not sell personal information or share it for cross-context behavioral advertising. California residents can exercise every right listed in the Privacy rights section.
ISO/IEC 27001In progress
Information security management system · 2022 edition
Our ISMS is being implemented against the ISO/IEC 27001:2022 requirements and Annex A controls.
SOC 2In progress
AICPA Trust Services Criteria · Security, Confidentiality, Availability
Controls are mapped to the Trust Services Criteria. A readiness assessment comes before the independent CPA examination.
Responsible AI
AI you can check
Transparency
We tell you when AI is involved and how. The Trust-IQ Score™ arithmetic is published, every point traces to a verified review or tested evidence, and your data never trains third-party AI models.
Fairness & bias mitigation
Every vendor is assessed against the same published criteria. Reviews are weighted by verified role, and payment never changes a score or ranking.
Accountability
Each AI system has a named owner. Scoring model changes are approved before release, and score-affecting events are logged.
Safety & reliability
AI features follow our secure development practices and are tested for accuracy, resilience and misuse such as fake reviews.
Human oversight
A person can review any AI output that affects a score, handle disputes and correct a result.
FAQ
Questions from procurement and risk teams
When will you hold ISO/IEC 27001 and SOC 2?
Both programs are in progress. We will publish the ISO/IEC 27001 certificate here once an accredited certification body issues it, and share the SOC 2 report under NDA once an independent CPA firm completes it.
Do you sign a Data Processing Agreement?
Yes. Our DPA covers GDPR Article 28 terms and Standard Contractual Clauses for international transfers. Request it from privacy@smartreviewai.io.
Where is my data stored?
With our cloud hosting providers. Data residency details and the subprocessor list are available on request.
Is my data used to train third-party AI models?
No. We do not use customer data or partner audit evidence to train third-party AI models.
What happens if there is a breach?
We follow a written incident response plan. Affected customers are notified without undue delay, and regulators within the deadlines the law sets, including 72 hours under GDPR and 6 hours to CERT-In for reportable incidents in India.
Can partners see who reviewed them?
Partners see verified review content and aggregate results. Reviewer identity verification data is used only to authenticate the review.