Legal
Security Overview
Last updated:
Smart Business Wizard is operated by AI Tech.
Your workspace holds some of your company’s most sensitive information. This page describes how we protect it. It is an overview, not a contractual commitment beyond what is stated in our Terms and DPA.
1. Infrastructure
The Service is hosted on Render, a managed cloud platform, with a managed PostgreSQL database, in United States (Render, Oregon region). Our hosting provider maintains physical security, network protections and redundancy for its data centers. Production systems are separated from development, and production credentials are injected securely rather than stored in code.
2. Encryption
- In transit: all traffic to the website and application uses HTTPS (TLS). Cookies used for authentication are marked secure.
- At rest: uploaded documents, receipts, invoices and imported spreadsheets are encrypted at the application level before storage; databases and backups are encrypted.
- Keys: encryption keys are held in private configuration, separate from the data and backups they protect.
3. Workspace isolation, roles and permissions
- Every request is checked on the server against the user’s accepted membership, company scope and role; hiding a button is never the only protection.
- Built-in roles (Super Admin, Admin, Accounts, Director, Employee, Contractor, Viewer, Workforce Manager) set sensible defaults, and actions such as create, edit, submit, approve, record payment, export, invite and assign are granted separately.
- Payroll details, full bank identifiers, imported statements and activity history require additional authority.
- Invitations use random, single-use, expiring, revocable tokens bound to the recipient and company; only a hash of the token is stored.
4. Authentication
Two-step sign-in for everyone: after the password, we email a 6-digit code that expires in 10 minutes and works once; new accounts confirm their email the same way. Signing in with Face ID, a fingerprint or the device PIN (a passkey) needs no code, because it already requires both the device and the person. You may trust a browser for 30 days. Passwords are stored only as salted, slow hashes using industry-standard algorithms. Initial or reset passwords must be changed at first login. Sessions expire after 8 hours and can be ended by signing out. Every sign-in is listed with its device and country, a new device triggers an email, and you can sign out all other devices at once.
5. Audit trail
An append-only activity history records significant actions (sign-ins, approvals, corrections, exports, invitations and permission changes), captured on the server and scoped to each company. Passwords, tokens and full payment identifiers are excluded or redacted. Financial records are corrected through linked reversals rather than silent edits, and period locks prevent changes to closed periods.
6. Network protection
Traffic to the website, the application and online shops passes through Cloudflare, which filters attacks and absorbs traffic floods before they reach our servers. Sign-in, sign-up and other sensitive requests are rate limited per visitor, and the application refuses requests from sources it does not expect.
7. Devices and offline use
Pages you opened and work you save without a connection are kept in your browser until they are sent, each with a one-time key so nothing is recorded twice. Signing out removes the kept pages. Signing in with Face ID or a fingerprint uses a passkey: your biometric never leaves your device.
8. Backups and availability
Databases are backed up regularly and backups are encrypted, with keys stored separately. We test restoration procedures. We monitor the Service for errors and availability. Enterprise customers may agree a specific SLA.
9. Staff access
The platform owner and a small number of authorized staff have administrative access to customer workspaces so they can operate, support and secure the Service. Access is bound by confidentiality obligations, is used only for those purposes or when legally required, and actions taken in a workspace are recorded in its activity log.
10. Babu assistant safeguards
Babu acts with the permissions of the signed-in person, so it cannot see or reveal records that person cannot access. It prepares drafts but never saves or submits records itself. Basic features run on our own servers; optional Babu AI requests are sent to our AI subprocessor only on plans where they are enabled, and are not used to train models.
11. Payments
Subscription payments are handled by Stripe, a PCI DSS Level 1 certified payment processor. Card numbers are entered directly into Stripe and never touch our servers.
12. Incident response
We maintain procedures to investigate, contain and recover from security incidents. If an incident affects your data, we will notify you without undue delay and in line with our DPA commitments.
13. Responsible disclosure
If you believe you have found a security vulnerability, please email security@smartbusinesswizard.com with details and steps to reproduce. Please give us reasonable time to fix it before any public disclosure, do not access or modify other customers’ data, and avoid degrading the Service. We will not pursue legal action against good-faith research that follows these guidelines.