Trust centre
Everything a vendor review asks for.
What we can share, what's under NDA and who to ask. For how the system itself is built, see the security page.
Documents
What you can get, and how.
Public documents open here. The rest is sent on request or under NDA, from the address that owns it.
Sent to you
The DPA and the sub-processor list come from privacy@smartbills.io. Questionnaires and testing details come from security@smartbills.io.
- Data processing agreementOn requestRequest
Our standard DPA, or a review of yours.
- Sub-processor listWith the DPARequest
Every company that handles customer data for us, and how you're told about changes.
- Security questionnaireOn requestRequest
We fill in yours instead of sending a generic pack.
- Security testing detailsUnder NDARequest
What testing we run and what it found.
Open here
Published pages. No request needed.
- Security overviewPublicOpen
Encryption, access, isolation and disclosure.
- Privacy policyPublicOpen
What we collect and people's rights over it.
- Terms and conditionsPublicOpen
The agreement that governs the service.
- Status pagePublicOpen
Live availability and incident history.
Certifications
We don't claim certifications we haven't finished.
When we hold one, it will be listed here with its scope, period and auditor. Until then, tell us what your review requires and we'll tell you exactly what we can provide.
Sub-processors
Who handles data for us
The companies that process customer data as part of running the service.
The current list comes with the DPA.
We keep it alongside the data processing agreement and send it with the DPA, together with how we notify you of changes. Ask and you'll have both.
privacy@smartbills.ioPrivacy law
The laws that apply to receipt data
A receipt identifies a person as soon as it's linked to one, which brings it under each of these. Ask and we'll give you our position under each one in writing.
European Union and United Kingdom
GDPR
Personal data of people in the European Union, and in the United Kingdom under its own version. Covers the legal basis for processing, people's rights, transfers and breach notice.
Quebec
Quebec Law 25
Applies to anyone handling personal information about people in Quebec, wherever the company is based. Requires privacy impact assessments, a person in charge of privacy, an incident register and express consent for sensitive information.
Canada
PIPEDA
Canada's federal law for personal information handled in commercial activity, alongside provincial laws where they apply.
United States
HIPAA
Protected health information held by health plans, providers and the companies that work for them. A receipt from a pharmacy or a clinic can carry it. Covers safeguards, limits on use and breach notice.
FAQ
Frequently asked questions
Get started
Tell us what your review needs.
Questionnaires, DPAs, sub-processor lists and architecture questions all go to one address. No sales call needed first.