Smartly Craft processes high-intent, often regulated conversations. Security isn't an addendum — it's how the platform is built. This page is the engineering view of how we keep your data safe.
1. Compliance & certifications
- SOC 2 Type II — audited annually by an independent firm.
- ISO/IEC 27001:2022 — full ISMS in place across product and ops.
- GDPR & DPDP Act compliant by design.
- Meta Business Solution Provider in good standing.
2. Encryption everywhere
TLS 1.3 in transit, AES-256-GCM at rest. Customer-side keys for media storage on Enterprise plans. End-to-end encryption is preserved for WhatsApp delivery; Smartly Craft only processes messages within Meta's authorized Business API surface.
3. Access controls
- Role-based access with row-level security in the database.
- SSO via SAML 2.0 and SCIM provisioning on Enterprise.
- 2FA required for all platform staff; production access is just-in-time, audited and time-boxed.
4. Infrastructure
Multi-AZ deployment on AWS with isolated VPCs per region. All inter-service traffic is mTLS. Daily snapshots, 35-day point-in-time recovery, quarterly disaster-recovery drills with documented RPO < 5 min and RTO < 30 min.
5. Secure SDLC
Every change goes through peer review, automated SAST/DAST, dependency scanning and policy-as-code checks before reaching production. Third-party penetration tests are commissioned twice a year and findings published in the trust portal.
6. Monitoring & response
24/7 security monitoring with anomaly detection on auth, API and webhook traffic. A documented incident response runbook, on-call security engineers and a public commitment to disclose material incidents within 72 hours.
7. Responsible disclosure
Found something? Email security@smartlycraft.com or submit via our HackerOne program. We acknowledge within 24 hours and never pursue good-faith researchers.