Trust Centre
How Smart Bricks protects institutional data: the controls in place, the compliance posture behind them, and the documentation available to your security team on request.
Compliance
The frameworks Smart Bricks is assessed against.
SOC 2 Type II
ISO 27001
GDPR · Compliant by design
Updated 28 September 2026
Controls
The controls protecting institutional data today, grouped by where they operate. Every control listed here is in production.
Infrastructure
Smart Bricks runs on hardened cloud infrastructure. Isolation and encryption are applied by default, not configured per customer.
Cloud deployment with redundancy across regions and availability zones
Dedicated tenant boundaries isolating data per institution
Encryption in transit with TLS 1.3
Encryption at rest with AES-256 and a dedicated key management service
Zero-retention agreements with every AI provider
Customer data trains Smart Bricks models only with your consent
Product
Identity, access and audit controls are configured by your administrators and enforced on every request.
Single sign-on via SAML 2.0 and OIDC
Multi-factor authentication enforced at the organisation level
SCIM provisioning and deprovisioning
Role-based access control across workspaces and portfolios
Audit logs covering who uploaded, downloaded and shared portfolio data
Deployment from managed multi-tenant cloud to single-tenant and private environments
Documentation
Smart Bricks maintains the documentation an institutional security review requires. Nothing is hosted publicly; every document is released to named institutions under NDA.
Available under NDA
Request any document below and our team responds with the current version. If your review needs something that is not listed, ask for it.
Subprocessors
The third parties that process institutional data on our behalf. The primary infrastructure subprocessor is published here; the full current list is available under NDA.
Subprocessor
Purpose
Region
Amazon Web Services (AWS)
Cloud infrastructure and hosting
United States, European Union
Subprocessor list updated 27 July 2026
Questions to ask any AI vendor
These are the questions an institutional security review should put to every AI company that wants access to its data, including Smart Bricks. Our answers are below.
Is our data ever used to train your models?
Only with your consent. Without your consent, customer data never trains a Smart Bricks model, and it never trains a provider’s at all. Every request runs under a zero-retention agreement, so inputs and outputs are processed in session and discarded rather than stored.
Where does our data live?
In the region you choose. Smart Bricks supports data residency in the key regions where we operate and sell: UAE, UK, EU and US, with redundancy across multiple availability zones. Residency is set per institution at deployment. For larger institutional clients, we can also support dedicated regional deployments and, where required, private cloud or on-premise deployments to meet specific security, regulatory and data-residency requirements.
Can we run Smart Bricks in an isolated environment?
Yes. Every institution sits inside a dedicated tenant boundary by default, so no portfolio is commingled with another’s. Where a mandate requires stronger separation, the same platform runs as a single-tenant or private deployment.
Who controls access to our data?
Your administrators do. Access is governed by single sign-on, enforced multi-factor authentication and role-based permissions, provisioned and revoked through SCIM against your own identity provider. Every upload, download and share is written to an audit log you can review.
What happens to our data if we leave?
Retention windows are configurable per institution, and on request or at offboarding all customer data is deleted from the environments Smart Bricks operates. Without your consent, nothing was ever placed in a shared model, so no copy persists in one.
Which third parties process our data?
Our core infrastructure can run across AWS, Azure and Google Cloud, allowing us to support different enterprise requirements and deployment configurations; the infrastructure subprocessor is named in the table above. Model providers process requests in session under zero-retention agreements. Your security team can request the complete list under NDA.
What compliance frameworks do you hold?
SOC 2 Type II and ISO 27001. GDPR: compliant by design.
What happens if there is a security incident?
You are notified without undue delay, consistent with GDPR, at the contacts your institution nominates. Recovery is supported by encrypted automated backups.
Every control is documented.
Request the control set, audit reports, and compliance documentation for your review.