Trust & security
How SmartRemit protects your data, where we stand on compliance, who processes data for us, and how to report a security issue. As of 2026-09.
Security overview
Non-custodial
SmartRemit never holds, receives or disburses customer funds. Licensed partners settle on their own rails.
Encryption in transit
HTTPS only, with HTTP Strict Transport Security.
Field-level encryption
Payout account details, identity-verification data and integration credentials are encrypted at the field level in our database (AES-256-GCM). A transfer draft waiting for payment keeps an unencrypted copy in the short-lived cache for up to 30 minutes.
Signed webhooks
Settlement instructions we send are signed with timestamped HMAC-SHA256, and status callbacks we receive are rejected when unsigned, mis-signed or stale.
Browser protections
An enforced Content-Security-Policy, and our pages cannot be framed.
Tenant isolation
Every partner-facing query is scoped to the partner; records you do not own are reported as not found.
Access to personal data is audited
Staff views and reveals of customer identity data are written to an audit trail.
Sanctions screening
Screening runs on every transfer and cannot be switched off. It currently checks a reference list; connecting a full government sanctions list is planned.
Rate limiting
Key public endpoints are rate limited per address, and the Partner API per partner and per key.
Staff sign-in
Staff accounts support multi-factor authentication.
Compliance status
Where we stand today. We will update this page when an examination or certification is complete.
| Framework | Status |
|---|---|
| SOC 2 | We have not undergone a SOC 2 examination. Our controls are being aligned to the AICPA Trust Services Criteria. |
| ISO/IEC 27001:2022 | We are not ISO 27001 certified. |
| UK GDPR / EU GDPR | We act as our partners’ processor for customer data. A data-processing agreement is in preparation. |
| PCI DSS | SmartRemit does not store, process or transmit cardholder data. Card funding is not enabled. |
| GLBA Safeguards Rule | We support partners’ Safeguards Rule programs as a service provider. |
| India DPDP Act 2023 | We are tracking DPDP Rules commencement (May 2027). |
| HIPAA | HIPAA does not apply to our service. |
Sub-processors
The third parties that process data to run the service. Where a region has not been verified yet, we say so.
| Provider | Purpose | Data | Region |
|---|---|---|---|
| Vercel | Hosting, serverless functions and scheduled jobs | Request data, application logs | United States (Washington, D.C. area) |
| Vercel Blob | Private file storage | Partner documents | Being confirmed |
| Neon | Primary database (the transfer ledger) | Transfers, customer records (sensitive fields encrypted), audit trail | United States (AWS US East, N. Virginia) |
| Upstash | Short-lived cache: sessions, recent conversations, one-time codes, rate limits | Phone numbers, recent chat text, short-lived transfer drafts (recipient name, phone and payout account details) | Being confirmed |
| Meta Platforms (WhatsApp Business Platform) | WhatsApp messaging | Phone numbers, message content, profile name | Being confirmed |
| Telegram | Telegram messaging | Phone numbers, message content, Telegram name and user ID | Being confirmed |
| Microsoft (Azure AI Speech) | Turns voice notes into text, when voice notes are on | Voice note audio | Being confirmed |
| Anthropic (Claude API) | AI model for the conversational agent and staff assistant tools | Conversation text, including recipient names and phone numbers | Being confirmed |
| Persona | Identity verification (when a partner uses SmartRemit-run identity verification) | Identity documents and details collected by Persona | Being confirmed |
| Hostinger | Email: our support mailboxes and transactional email (partner enquiries and invitations) | Email addresses, message content | Being confirmed |
Services we call that receive no personal data
- Frankfurter (European Central Bank exchange-rate data)
- Have I Been Pwned (password check by k-anonymity: only a hash prefix is sent)
Responsible disclosure
Found a security issue? We want to hear about it.
Email support@smartremit.ai with the subject “Security report”. Please do not report security issues in public.
In scope
- The smartremit.ai website and the pages it serves
- The SmartRemit Partner API
Please
- If you are a partner, use only your sandbox keys; test only with your own data.
- Report privately by email and include the steps to reproduce.
- Give us reasonable time to fix the issue before you disclose it.
Please don’t
- Access, change or delete data that is not yours.
- Run denial-of-service, spam or social-engineering tests.
- Send messages to phone numbers you do not own.
- Use live keys or real customer data.
We review every report, will acknowledge yours and keep you updated. There is no bug bounty programme today.
Safe harbour. We will not pursue good-faith security research that follows this policy. Draft, pending review by counsel.