Security at SmartCue
We take the security of your data seriously. Here's what we do to keep your demos and data safe.
Encryption in Transit
Traffic to SmartCue is encrypted with TLS 1.2 or 1.3. Earlier TLS versions are refused, and only forward-secret cipher suites are negotiated.
Encryption at Rest
Databases, backups, and stored media are encrypted with AES-256.
EU-Hosted Infrastructure
Account data and demo analytics run on Google Cloud in Frankfurt, Germany, across three availability zones.
Role-Based Access Control
Four roles — Admin, Editor, Viewer, Guest. Granular permissions for every team member.
Tenant Isolation
Every request is verified against your organization’s membership on the server, so one workspace is never reachable from another’s session.
Audit Logs
Track who did what, when, from your organization settings.
Backups and Recovery
Automated daily backups with point-in-time recovery across a 7-day window, stored in the EU.
Data Handling
We don’t sell your data. Demo content stays yours. See our Privacy Policy for details.
Additional Practices
- Rate limiting on authentication and other abuse-prone endpoints
- Passwords hashed with bcrypt, never stored or logged in plaintext
- Short-lived, cryptographically signed session tokens
- HTTP Strict Transport Security on our application domains
- Embedded demos run in a cross-origin iframe, isolated from your page
- DMARC enforced at reject, so email spoofing SmartCue is rejected outright
- Regular dependency updates and security patches
A Note on Where We Are
We're a lean team, not a Fortune 500. We don't have SOC 2 or ISO 27001 (yet). What we do have is a security-conscious engineering culture, transparent practices, and a commitment to doing right by our customers.
For security reviews we maintain a detailed Security Overview covering our architecture, data residency, sub-processors, the Chrome extension, and our backup and incident-response practices. We're happy to send it over, complete a security questionnaire, or provide a Data Processing Agreement.