How it works
How Smartbox works.
For IT, security and information governance reviewers: how material comes in, how decisions are made and recorded, how redactions are applied and checked, and where your data is processed.
01At a glance
- 01Sources
- 02Intake and processing
- 03Review and decisions
- 04Redaction and checks
- 05One release point
Alongside every stage: the hash-chained ledger.
Material comes in once, with its source recorded. It is processed, reviewed, redacted and checked, and it leaves through one release point. Every step is written to a hash-chained ledger.
02Sources and formats
SharePoint, OneDrive and Exchange in Microsoft 365; Box and Dropbox; forensic images; dictation systems; and bulk or email uploads. Mail in PST, OST, EML, MSG, MBOX and OLM; Office documents, PDFs and scans; audio and video, including body-worn video and CCTV. Each item's custodian, source, method and content hash are recorded.
03Processing
Duplicates and email threads are resolved first. Scans and images are read by OCR, and audio and video are transcribed with speakers separated.
04Detection
Patterns, dictionaries you control, and non-generative classification find what may need to be withheld. No general-purpose AI makes a withholding decision, and the same document processed twice gives the same result.
05Decisions
Reviewers decide. Each mark carries its category, legal basis, statutory reference and the reviewer's name, and legal bases are configured for each regime. Where your workflow requires it, a second person approves.
06Redaction and release
Redactions are burned in on the server, into a new copy; the original is never altered. Finalised copies are re-read by OCR and checked against the decisions. Everything leaves through one release point, as sealed, numbered productions with a hashed manifest.
07Audit and custody
Every lifecycle event is written to an append-only, hash-chained ledger. Every redaction is recorded with its reviewer and the document hash. Every access is logged, and support staff reach your environment only with your approval.
08How we use AI
Detection proposes; people decide.
Your data is not our training data
We do not train on customer material. Our models are trained on our own content, on synthetic data we generate, and on sources we hold written authorisation to use — with a named owner and a date against that authorisation. Nothing you put into Smartbox teaches the model, and nothing another customer puts in has taught the one that reads your files.
We can show you why, not just what
When the platform flags something as personal data, it can show which words in the document drove that decision — not just the verdict.
The same file, the same answer, every time
Run the same document through Smartbox twice and you get the same result. Two reviewers, a month apart, get the same result. Every version of our detection is fingerprinted, so if a decision is questioned a year later we can identify exactly which one made it and run the file through it again.
09Security and hosting
- ISO/IEC 27001:2022, certified by BSI — certificate IS 811455.
- Cyber Essentials Plus certified.
- UK-only processing.
- Weekly automated penetration testing by a CREST-accredited provider.
- Support staff reach your environment only with your approval, and every access is logged.
- Every lifecycle event is hash-chained, and every redaction is recorded with its reviewer and the document hash.
- No generative model decides what is withheld, and the same input always gives the same result.
10Integrations and the API
Start now. Go live on Gen 2.
Choosing and approving a disclosure platform takes time. Start the conversation now, and plan your move around general availability in January 2027.