1. Security approach
We use layered, proportionate security measures based on the service, the sensitivity of the information and the risks involved. Security is considered when services are designed, configured, changed and supported.
2. Access and accounts
- Access is assigned on the basis of role and operational need.
- Users must keep credentials confidential, use strong unique passwords and not share accounts.
- Administrator access is limited to the people who need it to operate or support the service.
- Access should be reviewed and removed when a user’s role ends or changes.
3. Platform and supplier controls
We use managed technology providers appropriate to the relevant SBS system, including Supabase, Resend and Cloudflare services. We consider provider security and data-protection measures when selecting and maintaining services, and use secure connection methods where available.
4. Secure operation
We maintain processes for service changes, protection of secrets and credentials, appropriate backups, monitoring and review. We seek to address identified vulnerabilities and security issues in a proportionate and timely way.
5. Security incidents
We investigate suspected unauthorised access, disclosure, loss or alteration of data. We will take reasonable steps to contain and remediate an incident and will notify affected customer organisations where required by our role and agreement.
6. Reporting a concern
If you believe an SBS account, application or website has a security issue, contact info@smart.businesssolutions.com with a description of the issue. Please do not include passwords, payment details or other sensitive information in an unencrypted email.