Security Measures (Technical and Organizational Measures)
Smarty maintains a documented information security program that includes administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of systems and data processed through the Subscription Services. Smarty may update and modify the Security Measures from time to time, provided that such updates and modifications do not result in a material degradation of the overall security of the Subscription Services provided under the Agreement.
Information Security Policies and Measures
Smarty maintains a comprehensive information security program that defines how it manages and protects its systems, data, and services. This program includes:
- Policies and Governance: Documented security policies and procedures approved by Smarty’s compliance team and communicated to relevant personnel.
- Policy Review: Policies are reviewed at least annually or upon material change to confirm their applicability and effectiveness. Smarty does not modify policies in a manner that would materially reduce its security obligations.
- Privacy Program: A formal privacy program governs the collection, use, and sharing of Personal Data in accordance with applicable laws and regulations.
- Security Reviews: Independent reviews of Smarty’s information security framework, including control objectives, policies, processes, and procedures, are conducted at planned intervals.
- Testing and Validation: Smarty regularly tests and evaluates the effectiveness of its technical and organizational measures to ensure ongoing protection of Subscriber Data.
- Disaster Recovery and Business Continuity: Smarty maintains disaster recovery and high-availability plans consistent with industry standards. These plans are tested at least annually to ensure the confidentiality, integrity, availability, and resilience of systems supporting the services.
Risk Assessment and Asset Management
Smarty conducts periodic risk assessments to identify, evaluate, and mitigate potential security risks. It maintains processes for risk monitoring, reporting, and remediation. An asset management program classifies and manages hardware and software assets throughout their lifecycle to ensure appropriate protection and accountability.
Personnel Security, Training, and Awareness
Smarty ensures personnel integrity and security awareness through:
- Confidentiality Obligations: All personnel are bound by written confidentiality agreements.
- Background Screening: Pre-employment background checks and other screenings are conducted where appropriate.
- Training: All employees complete annual security and privacy awareness training covering data protection principles, confidentiality obligations, and company security policies.
Access Management and Technical Controls
Smarty implements robust access and authentication controls to protect systems and data:
- Access Control: Access is governed by role-based access control and the principle of least privilege, ensuring users have only the permissions necessary for their job functions.
- Authentication: Multi-factor authentication (MFA) and other secure methods (e.g., strong passwords, tokens, or biometrics) are enforced.
- Access Review: Access rights are promptly modified or revoked upon termination or role change.
- Technical Controls: Measures that prevent unauthorized use of data processing systems, including user identification, password security, session timeouts, and intrusion-attempt monitoring.
Hosting and Physical Security
Smarty’s Subscription Services are hosted on industry-leading, security-certified cloud infrastructure to ensure performance, reliability, and scalability.
While third-party cloud providers manage and secure the underlying physical infrastructure, Smarty remains responsible for the design, implementation, and maintenance of its services and security controls.
Physical access controls implemented by these providers include:
Segmented access zones and role-based authorization; electronic key management systems; 24x7 monitoring through a global security operations center; video surveillance, alarm systems, and secure locking mechanisms; and trained, uniformed security personnel. Smarty reviews third-party audit reports to confirm appropriate physical access controls are maintained at all managed data centers.
Operations and Network Security
Smarty enforces operational and network security measures, including:
- Policies and Procedures: Documented procedures for system hardening, change management, separation of environments, network security, encryption, data integrity, and logging.
- Malware Protection: Anti-malware controls protect systems from malicious software originating from public or internal networks.
- Configuration and Change Management: Only approved software and configurations are deployed in production. Changes are reviewed and approved through formal processes.
- Encryption of Data: Data is encrypted in transit using TLS (v1.2 or higher) and at rest using AES-256 or equivalent encryption.
- System Integrity: Systems used to provide services are monitored for faults to prevent data corruption and ensure reliable operation.
- Network Security: Industry-standard controls (e.g., firewalls, network segmentation, and access rules) are implemented across all network services.
- Intrusion Detection and Prevention: Intrusion detection and/or prevention systems continuously monitor hosted environments, identify and respond to security events in real time, and are promptly updated as new releases become available.
Secure Development and Maintenance
Smarty maintains secure application development and maintenance practices aligned with industry standards.
- Application Security: Secure development policies and standards govern all stages of design, coding, testing, and deployment.
- Hardening and Patching: Systems are built using hardened configurations, removing unnecessary accounts, services, and open ports. Patches and updates are applied promptly, and unsupported software is decommissioned.
- Administrative Privileges: Privileged access is limited to authorized personnel with a verified business need and appropriate training.
- Workstation Security: All employee laptops and workstations use full disk encryption (AES-256).
Vulnerability and Penetration Testing
Smarty performs regular vulnerability assessments and penetration tests across systems and applications.
- Vulnerability Scanning: Internal environments are scanned monthly, and external systems are scanned weekly. High-risk vulnerabilities are remediated within 30 days.
- Application Testing: Security assessments are performed before each public release.
- Independent Testing: A third-party penetration test is conducted at least annually. Upon request (no more than once per year), Smarty provides a written assertion confirming completion and remediation of findings.
Data Management
Smarty implements controls to ensure the confidentiality, integrity, and availability of data throughout its lifecycle.
- Data Protection: Data cannot be read, copied, modified, or deleted without proper authorization during transmission, storage, or transport.
- Monitoring and Audit: Audit trails and logging systems track data access, modification, and deletion.
- Segregation of Data: Data collected for different purposes is processed separately through least-privilege access, environment segregation, and logical segmentation.
Business Continuity and Availability
Smarty maintains business continuity and disaster recovery plans that are consistent with industry standards and periodically tests them to ensure the continued availability and resilience of its Subscription Services.
Data Security Incident Management and Notification
Smarty maintains a data security incident management program that addresses the detection, response, and notification of data incidents. Impacted Subscribers and regulatory authorities are notified in accordance with applicable laws and contractual requirements.
Certifications, Audits, and Reviews
Smarty maintains System and Organization Controls (“SOC”) auditing standards. A SOC 2 + ISO 27001:2022 Annex A report is produced annually and may be provided upon request under a mutual confidentiality agreement. Smarty may adopt additional standards or certifications as appropriate.
System Configuration
Smarty uses automated deployment and configuration management tools to enforce standardized, secure infrastructure settings. All configuration changes undergo formal code review and approval prior to release. Monitoring tools detect deviations from approved baselines.
Data Retention and Deletion
Smarty maintains documented data retention and deletion policies that define how and when data is retained, archived, or securely deleted in accordance with legal and contractual obligations.