HOSTING AND SECURITY
Hosting, security and your data.
Updated
Where SmartFACT runs, who can sign in, what is backed up and what you can take away. Plain statements, including what is not in place.
Hosting
SmartFACT is a hosted service. It runs in the UK, with database backups encrypted and copied off-site to the EU. Each product keeps its own database. LabelRules Pro can run production on your own infrastructure, with authoring in the SmartFACT cloud.
We do not name the hosting providers on this page.
Sign-in and access
Access is through SmartFACT Accounts: your organisation's administrator decides who has access to each product and in which role, and while SmartFACT is in early access we enable the organisation and its first users. Every person signs in with their own account; there are no shared station logins, so every approval, correction and release is attributable to a named person. Approvals in SmartFACT Purchasing and in SmartFACT Automation require a fresh second factor. Single sign-on with your own identity provider is not offered.
Certifications
SmartFACT holds no security certification today: no ISO 27001 and no SOC 2. Cyber Essentials certification is being arranged, and this page will say when it is held, with the date.
No product claims compliance with a regulated-industry standard such as 21 CFR Part 11, ISO 13485, BRCGS or EPCIS. LotTrail, ReclaimStation and CheckStation each say on their own pages what they record and what they do not certify.
Backups and your data
Backups are part of the service and are tested. Each product lets authorised people download their organisation's data: LotTrail's saved runs as JSON and PDF evidence packs, ParcelOffice's complete history export, Purchasing's order documents and SmartFACT Data's saved table versions, for example. Downloads are for your own use and never make anything public.
Enquiries on the product sites are encrypted at rest and deleted on a schedule; each site's privacy notice gives the details. Production data belongs to you under the agreement made at onboarding.
AI and your data
Only the plain English rule text you write goes to the AI provider, to produce a proposal, under terms that exclude training on your data. Production data never does. The AI page explains the whole arrangement.
Common questions
Is SmartFACT GDPR compliant?
SmartFACT is operated by a UK company under UK GDPR. The privacy notice on each site says what is collected, why, for how long and how to ask about it. Compliance for your own processing of personal data remains yours.
Can we run it on our own servers?
LabelRules Pro can run production on your infrastructure. The other products are hosted services.
Who can see our data?
The people your organisation authorises through SmartFACT Accounts, and the SmartFACT team operating the service. We do not sell data, and we use your data for nothing but running the service for you.
Something here does not match what you have read elsewhere? Write to [email protected] and we will put it right.
Explore the SmartFACT suite →