Built for procurement
A platform your security team can sign off.
Engineered for UK regulated buyers — procurement-ready out of the box. Every control on this page maps to a question already asked by NHS DSPT, ISO 27001, Cyber Essentials Plus, and most enterprise security teams.
Certifications and frameworks
What we hold.
Cyber Essentials Plus certified
UK government-backed cyber security baseline, independently audited.ISO/IEC 27001:2022, certified by BSI — certificate IS 811455
Independently audited information security management across the platform.UK GDPR / Data Protection Act 2018
Aligned by design. The platform is engineered for UK regulatory work.NHS DSPT, Liberty Global GTC
Past responses to UK public-sector and commercial-enterprise procurement standards available on request.
Assurance at a glance
- ISO/IEC 27001:2022, certified by BSI — certificate IS 811455.
- Cyber Essentials Plus certified.
- UK-only processing.
- Weekly automated penetration testing by a CREST-accredited provider.
- Support staff reach your environment only with your approval, and every access is logged.
- Every lifecycle event is hash-chained, and every redaction is recorded with its reviewer and the document hash.
- No generative model decides what is withheld, and the same input always gives the same result.
Platform facts
The controls behind the certifications.
Tenant isolation & data residency
Logical isolation per tenant on Public Cloud (UK AWS regions). Physical isolation on Private Cloud (single-tenant deployment, dedicated AWS account, per-tenant encryption keys). BYOC (Bring Your Own Cloud) for customers whose data must stay in their own cloud organisation, where the environment is theirs and we have no visibility of it at all.Access only with your approval
Support staff reach your environment only with your approval, and every access is logged. Smartbox is software, not a managed service: there is no review team here reading your files.Customer-hosted deployments go further still — where you run Smartbox in your own cloud organisation, the environment is yours, we do not operate it, and we have no access to it at all. That is also why the question of SC-cleared personnel does not arise: clearance governs the people who access material, and on a Smartbox deployment those people are yours.
Identity, access & audit
SSO (SAML / OIDC) and enforced MFA. Role-based access control — Reviewer, Redactor, Approver, Admin — with per-matter overrides and matter-level information barriers. Immutable audit log across every user action, exportable for compliance review.Encryption, integrity & malware
AES-256 at rest, TLS 1.2+ in transit, per-tenant encryption keys on Private Cloud. Antivirus scan on every file at ingestion — reviewers never open an infected attachment. Every file fingerprinted with SHA3-256 at ingest, and every lifecycle event written to an append-only, hash-chained ledger.
FAQ
Frequent procurement questions.
Where is data hosted?
UK AWS regions by default. Private Cloud deployments run in a dedicated AWS account. For customers who need the environment entirely under their own control, Smartbox runs in your own cloud organisation.Will the audit trail stand up at Tribunal?
Files are fingerprinted with SHA3-256 at ingest. Every lifecycle event — ingestion, classification, redaction, override, disclosure — is then written to an append-only ledger where each row is SHA-256 hash-chained to the one before it, so tampering is detectable by re-verification. Nothing updates or deletes a row. The trail is exportable for ICO submissions and reconstructable at Tribunal.Do your staff need security clearance to handle our data?
No. Support staff reach your environment only with your approval, and every access is logged. Smartbox is software, not a managed service, so there is no review team here handling your files. Customers who need the environment itself under their own control run Smartbox in their own cloud organisation, where we have no access at all.
Start now. Go live on Gen 2.
Choosing and approving a disclosure platform takes time. Start the conversation now, and plan your move around general availability in January 2027.