Este conteúdo ainda não está traduzido para português. É apresentada a versão original em inglês.
Smart Role trains support teams on realistic customer conversations. Those conversations, and the people who take part in them, deserve the care of production customer data. This page describes the measures in place today. Our contractual commitments are on our GDPR page and in our privacy policy.
Hosting in Europe
- The application runs on Vercel, with its server functions in the Paris region.
- The database is a MongoDB Atlas cluster hosted on AWS in Frankfurt, replicated across three nodes.
- Uploaded files are stored on Amazon S3, also in Frankfurt.
- The AI behind simulations and feedback runs on Smart Role's own Azure OpenAI deployments in Europe, in France and Sweden. Microsoft does not use the data sent to these deployments to train its models.
- Our hosting configuration (application projects, domains, environment settings) is managed as code with Pulumi, rather than changed by hand.
Encryption
- All traffic is served over HTTPS. The application sends an HSTS header for one year, subdomains included, so browsers refuse unencrypted connections.
- Stored data is encrypted at rest by our storage providers: MongoDB Atlas and Amazon S3 encrypt data on disk by default.
- Secrets such as API keys and database credentials are never kept in plain text in our code: our environment files are encrypted, and their decryption keys are held outside the repository.
Authentication and access control
- Users sign in with an email and password, with Google or with Microsoft.
- Enterprise customers can use single sign-on with SAML 2.0, with signed assertions required, and SCIM provisioning so that access follows your identity provider.
- Passwords are hashed with bcrypt and never stored in plain text. Sessions expire after seven days, and session cookies are only sent over HTTPS.
- Permissions are role-based: what a user can see or change depends on their role in the workspace, and administrators can define their own roles.
- Records keep track of who created and last changed them, and deleted records can be restored.
- Public forms such as sign-up are protected against bots with reCAPTCHA.
Customer data isolation
Each customer's data belongs to its own organization and workspaces. The API scopes reads and writes to the workspace of the signed-in user.
Application security
- Security headers protect the application against clickjacking (it cannot be embedded in another site), content-type sniffing and downgrade to HTTP.
- API inputs are validated against typed schemas before they reach the database.
- The administration console runs on a separate domain from the customer application, and is kept out of search engines.
- Our Cloudflare workers, which convert documents and browse web pages, block malicious requests before they are processed: known attack paths, vulnerability scanners and attempts to reach internal networks.
- The application went through a penetration test in 2026. Fixes for its findings shipped in August 2026, among them stricter scoping of customer data, clickjacking protection, HSTS and secure session cookies.
Monitoring and availability
- Application errors are reported to Sentry, so the team sees them as they happen.
- The live state of the platform is published on our status page.
- Changes reach production through automated deployments.
Compliance
Smart Role acts as a data processor for the data you process on the platform. Our GDPR page covers our role, data processing agreements and how to exercise your rights. Our trust center gathers our security documentation.
Reporting a vulnerability
If you believe you have found a security issue in Smart Role, write to support@smartrole.ai with a description and the steps to reproduce it. We will look into it and keep you informed. Please do not access or alter other customers' data, and give us the time to fix the issue before disclosing it.
Perguntas frequentes
Where is our data hosted?
In Europe. The application runs on Vercel in the Paris region, the database on MongoDB Atlas (AWS, Frankfurt), uploaded files on Amazon S3 (Frankfurt), and the AI on Smart Role's own Azure OpenAI deployments in France and Sweden.
Is our data encrypted?
Yes, in transit and at rest. All traffic goes over HTTPS, and the application asks browsers to refuse unencrypted connections for a year (HSTS). On disk, MongoDB Atlas and Amazon S3 encrypt stored data by default.
Do you use our data to train AI models?
No. Smart Role does not train or fine-tune models on your data: the AI runs on our Azure OpenAI deployments, and Microsoft does not use data sent to Azure OpenAI to train its models.
Who can access our data?
Within your organization, access depends on each user's role in the workspace, and administrators can define their own roles. The API only returns data from the signed-in user's workspace. On Smart Role's side, the team operates the service through an internal administration console served on its own domain.
Do you support single sign-on?
Yes. Users can sign in with Google or Microsoft, and enterprise customers can use SAML 2.0 single sign-on, with signed assertions required, along with SCIM provisioning so access follows your identity provider.
How are passwords and sessions protected?
Passwords are hashed with bcrypt and never stored in plain text. Sessions expire after seven days, and session cookies are only sent over HTTPS.
Has Smart Role been penetration tested?
Yes, in 2026. The fixes for its findings shipped in August 2026. To discuss it as part of a security review, write to support@smartrole.ai.
Can we sign a DPA or send you a security questionnaire?
Yes. Our GDPR page describes our role as a data processor and our data processing agreements. For a DPA or a security questionnaire, write to support@smartrole.ai.
How can we have our data exported or deleted?
Smart Role supports data export and deletion requests under the GDPR. Send them to privacy@smartrole.ai; our GDPR page explains how these rights apply.
How do I report a security issue?
Write to support@smartrole.ai with a description and the steps to reproduce it. Please do not access or alter other customers' data, and give us the time to fix the issue before disclosing it.