Security
Receipt data, protected.
A receipt says what a business bought, where, and on which card. Smartbills encrypts it, limits who can reach it, never stores the card number and logs every access.
Controls
Controls in place
Certifications and audit reports are on the trust centre.
Data
- Encryption in transit
- TLS on every connection: browsers and apps to Smartbills, between internal services, and to integration partners.
- Encryption at rest
- Databases, file storage and backups are encrypted with managed keys.
Access
- Production access
- Role-based, granted for a stated reason and reviewed. Accounts are individual and every admin tool requires multi-factor authentication.
- Tenant isolation
- Every record belongs to one organization and every query is scoped to it in the data layer.
Operations
- Portal credentials
- Supplier and utility portal sign-ins used by bill fetching are kept in a managed vault, never in config files or logs.
- Audit log
- Every view and change is logged with who and when. Corrections are new entries, and the original stays.
Data residency
Confirmed per market, in writing.
Tell us where you operate. You get the storage location for each market in writing before you sign.
security@smartbills.ca
Responsible disclosure
Reporting a vulnerability
Report it by email. Every report gets a reply within two business days, under the terms below.
- Scope
- In scope: smartbills.io, the apps and the APIs. Out of scope: denial of service, social engineering and physical attacks.
- Good faith
- Research done in good faith under these terms will not be met with legal action. Ask first and we confirm it in writing.
- Response
- A reply within two business days. Once the issue is reproduced, you get a date for the fix.
- Credit
- Public credit when the fix ships, unless you decline it.
For a security review
The DPA, the privacy policy, the status page and what consent covers.
FAQ
Frequently asked questions
Yes. Send it and it comes back answered question by question, not as a standard pack. Anything we cannot answer yet is marked as such, with the reason.
Testing details and reports are shared under NDA, not published. Request them through the trust centre.
Export it any time while the account is active. After termination it is deleted on the schedule in your agreement, except records the law requires us to keep, usually for a tax retention period.
The contact on your account is notified within the time your agreement and the law require. Quebec's Law 25 and the GDPR both set that obligation. Outages are posted on the status page as they happen.
Get started
Running a vendor review?
Send the questionnaire, the DPA or your list of questions. Answers come before you sign.