Trust
Security & Data Protection
This page describes our current security approach at a high level. It is not a penetration-test report, certification or guarantee that incidents cannot occur.
Security principles
- Privacy and data protection by design and by default.
- Least-privilege access and role-based administrative controls.
- Separation of development/testing and production environments.
- Protected private object storage for supported customer files.
- Audit logging for security, administrative and AI-governance events.
- Encryption in transit and encryption/protection of sensitive application data where appropriate.
- Credential and secret management through deployment environment configuration rather than source code.
- Controlled subprocessor selection and contractual data-protection obligations.
- Security and dependency maintenance as part of the development lifecycle.
AI privacy controls
SSC includes configurable governance controls intended to reduce unnecessary disclosure of protected information to AI providers, including anonymisation and governance/audit records. Customer configuration and user behaviour remain relevant to overall risk.
Incident management
We maintain procedures for assessing suspected security and personal-data incidents and for supporting controllers with legally required breach assessment and notification.
Responsible disclosure
To report a suspected security issue, contact support@smartshift.consulting. Do not include live credentials, unnecessary personal information or exploit data beyond what is needed to identify the issue.