Skip to main content
Save 30% on your first year

Security

How we protect your receipt data.

Receipts show what a business bought, where, and on which card. This page covers how that data is stored, who can reach it, what we don't hold at all, and where to send a security question.

Trust centreReport a vulnerability
A customer taps a card on a payment terminal at a store counter

Controls

What is in place today.

How the product is built right now, grouped by what each control protects. Anything that needs an auditor's sign-off is listed on the trust centre.

Data

Encryption in transit
Every connection uses TLS: from browsers and apps to us, between our own services, and from us to integration partners.
In place
Encryption at rest
Databases, file storage and backups are encrypted with managed keys. Backups get the same protection as the live data.
In place

Access

Access to production
Access is role-based, granted for a stated reason and reviewed. There are no shared accounts, and every admin tool requires multi-factor authentication.
In place
Tenant isolation
Every record belongs to one organization, and every query is scoped to it in the data layer. A missing filter in application code can't expose another customer's data.
In place

Operations

Portal credentials
The sign-ins bill fetching uses to reach supplier and utility portals are kept in a managed vault. They never appear in config files or logs.
In place
Audit log
Views and changes to records are logged with who did it and when. A correction is saved as a new entry, and the history can always be rebuilt.
In place

Data residency

We confirm it per market, in writing.

Tell us where you operate and we'll put the answer in writing before you sign anything. A specific answer for your jurisdiction is worth more than a general one that doesn't hold.

security@smartbills.io
A cork world map on a wall above a desk with a laptop

Responsible disclosure

Found a vulnerability? Email us first.

We don't run a paid bug bounty. We do answer every report, on these terms.

Scope
In scope: smartbills.io, our apps and our APIs. Out of scope: denial of service, social engineering and physical attacks.
Good faith
We won't take legal action over research done in good faith under these terms. Ask first and we'll confirm it in writing.
Response
We reply within two business days. Once we've reproduced the issue, we'll give you a date for the fix.
Credit
When the fix ships, we'll credit you publicly, unless you'd rather we didn't.
Email the security team
Hands typing code on a laptop at a desk

Useful for a security review

The DPA, the privacy policy, the status page and what consent covers.

FAQ

Frequently asked questions

Yes. Send it over and we'll answer it directly instead of sending a standard pack. If there's a question we can't answer yet, we'll tell you which one and why.

We share testing details and reports under NDA, not on a public page. Ask through the trust centre and we'll tell you what's available.

You can export it any time while your account is active. After termination we delete it on the schedule in your agreement, except records the law requires us to keep. For receipts and transactions, that's usually a tax retention period.

We'd contact the person listed on your account, within the time your agreement and the law require. Quebec's Law 25 and the GDPR both set that obligation. Outages are posted on the status page as they happen.

Get started

Working through a vendor review?

Send us the questionnaire, the DPA or your team's list of questions. We'd rather answer them before you sign than halfway through onboarding.

Contact usTrust centre