Security at Smart Bricks
How Smart Bricks protects your deals, documents and portfolios: data security, privacy, AI governance, enterprise controls, deployment and compliance.
Request a DemoBuilt-in security capabilities
Every layer of Smart Bricks is designed to protect your data, ensure privacy, and give you full control over how and where your platform runs.
Encrypted at rest and in transit
All customer data is encrypted at rest and in transit, under dedicated key management.
Tenant-isolated data
Dedicated tenant boundaries keep your deals, documents, and models from ever commingling with another institution’s.
Authentication and access
SSO via SAML 2.0 and OIDC, enforced MFA, SCIM provisioning, and role-based access so every member sees only what they should.
Cloud and private deployment
Redundancy across multiple regions and availability zones, from fully managed multi-tenant cloud to single-tenant and private deployments.
Zero data retention
Nothing you upload is retained by our AI providers. Every request is processed in-session under zero-retention agreements, GDPR-compliant by design.
Audit visibility
User activity is tracked in audit logs built for compliance, covering who uploaded, downloaded, and shared portfolio data.
AI governance
Every output is scored for confidence and traced to its source; anything below threshold goes to a person.
Your data never trains our models without your consent.
Smart Bricks is AI-native, so data protection is non-negotiable. We run under zero-retention agreements with our AI providers, and every model interaction is isolated to your tenant, with no cross-tenant context, ever.
Deployment model, data residency and model policy
Settled before your first security review.
No deployment blocker
Self-hosted, single-tenant or hybrid, so funds that cannot send data to a third-party cloud can still use Smart Bricks.
No model lock-in
The routing layer picks the model per task, from our own proprietary models and 30+ frontier models, within a client’s approved-vendor list, so that list never becomes a gating item.
Data residency by jurisdiction
Data residency in the key regions where we operate and sell: UAE, UK, EU and US. For larger institutional clients, dedicated regional deployments and, where required, private cloud or on-premise deployments to meet specific security, regulatory and data-residency requirements.
Secure by architecture, not by afterthought.
From key management to network isolation, security is engineered into every layer of the platform, not bolted on after.
Encryption everywhere
Every byte is protected in motion and at rest, with keys you control and can audit.
- AES-256 encryption at rest
- TLS 1.3 for all data in transit
- Dedicated KMS with regular key rotation
Hardened cloud infrastructure
Defence in depth at every layer of an enterprise-grade cloud, monitored continuously.
- Core infrastructure can run across AWS, Azure and Google Cloud
- VPC isolation with WAF and DDoS protection
- Continuous vulnerability scanning across the platform stack
- High availability with monitored failover
You stay in control of your data.
From residency to deletion, you decide how and where your data lives. Every control is documented and leaves an audit trail.
- Full data deletion on request or offboarding
- Configurable retention windows, set per institution
- Encrypted automated backups and disaster recovery
- A published list of every subprocessor that touches your data
- Data Processing Agreement available on request
- Breach notification without undue delay, consistent with GDPR
Built to the security and compliance standards institutional capital requires.
- SOC 2 Type II
- ISO 27001
- GDPRCompliant by design
Your security review starts here.
Talk to our team about your firm’s security, compliance, and deployment requirements.
Security researchers, vulnerability disclosures and other security-related enquiries: security@smart-bricks.com
Explore the Trust Centre
Every control on this page is backed by documentation your security team can request and review. The Trust Centre organises it in one place.
- Security documentation, released to named institutions under NDA
- The subprocessor table, with the complete list available on request
- The questions an institutional review should ask any AI vendor, answered