Your data, protected
SmartAssessor is built for organisations handling sensitive compliance evidence. Security is foundational to everything we do, not an add-on. We’re independently certified, regularly audited and committed to protecting your data at every level.
Independently Certified
We don’t just talk about security. We prove it. Sendient holds independent certifications that demonstrate our commitment to data protection, operational security and quality management.
ISO 27001
Information Security Management, with independently audited controls for protecting sensitive data
Cyber Essentials Plus
UK Government-backed certification that protects against common cyber threats
ISO 9001
Quality management systems for consistent, reliable and continuously improving service delivery
ONE SECURE HUB FOR ALL YOUR AUDIT NEEDS
SmartAssessor gives your team the visibility, control and confidence to stay audit-ready all year round.
How we protect your data
From encryption to access controls, here’s how SmartAssessor keeps your compliance evidence secure.
EncryptionData encrypted in transit and at rest using industry-standard protocols
Access ControlRole-based permissions ensure only authorised users can view or approve
Audit TrailEvery action is logged and time-stamped for complete traceability
Secure HostingHosted on secure, enterprise-grade cloud infrastructure with strict controls
Where your data lives and how we handle it
SmartAssessor is hosted on secure, enterprise-grade cloud infrastructure. We’ve designed our data handling practices to meet the expectations of regulated industries, because we know your compliance evidence is sensitive.
Data Residency
Data may be transferred between the UK, the EEA and the US. Where data leaves the UK or EEA, we rely on appropriate safeguards such as the UK International Data Transfer Agreement and the EU Standard Contractual Clauses. Our AI model providers (Anthropic, OpenAI and Google) may process data in the US, and must not use your data to train their models.
GDPR Compliance
SmartAssessor operates in full alignment with GDPR. We process data lawfully, transparently and only for the purposes needed to deliver our service to you.
Data Retention
We retain your data only for as long as necessary to provide our services. When you leave SmartAssessor, your data is securely deleted in line with policy.
No Third-Party Sharing
Your data is never sold or shared with third parties for marketing. We use limited vetted sub-processors, all bound to the same security standards.
RESPONSIBLE AI
How we use AI
Advisory, and reviewed
AI outputs are advisory and are reviewed by a qualified user before they’re acted on or formally recorded.
No training on your data
We don’t use customer data to train, fine-tune or improve any AI model, and we require our model providers to apply the same restriction.
Our model providers
Models from Anthropic, OpenAI and Google, on zero-retention terms where available.
Sub-processors
Each is bound by a written data processing agreement or equivalent commitment. Further information about our sub processors, including their role, location, and the types of data they process, is available to Customers on request.
RETENTION
How long we keep your data
We keep personal data for the length of your contract plus 90 days, so it can be returned or deleted, unless you tell us to keep it longer for your own accreditation, certification or regulatory obligations. Certification audit trails often need keeping for three to seven years, depending on the scheme.
Backups and security logs follow separate, shorter retention cycles and are only restored or reviewed for disaster recovery, incident investigation or audit.
At the end of the period we securely delete or anonymise personal data, unless the law requires us to keep it.
Questions about security?
Our team is happy to discuss our security practices, provide documentation or answer any questions during the sales process.