Security & users · For everyone
How Your Data Stays Safe
Explained Without the Jargon
A plain-language guide for business owners and clients: how your data is kept apart from other companies, who inside your company can see what, how it is protected from attackers, and what you can switch on.
About & Business Case #
"Can other companies on SmartLite see my data? And what about hackers?" #
It's the first thing a careful customer asks, and the right question. SmartLite is one service that many companies use at the same time, like an office building with many tenants. This page explains, in plain words, why your records stay yours: what keeps other companies out, what keeps attackers out, and what controls you have inside your own company.
The short answer:
- Your company's data sits in its own locked space. Every request for it is checked twice, by two separate guards, for which company is asking.
- Everything travels encrypted, is stored encrypted, and needs a proper sign-in to reach.
- Inside your company, you decide who sees which records, and even which fields.
- Changes are recorded, and changes to your setup are tested before they go live.
Use this page with clients
Share the link, or walk through the diagrams in a meeting. Each section stands on its own.
How It Works #
Kept apart from other companies #
Think of SmartLite as a building where every company has its own locked room. Your team has a key to your room only. There is no door between rooms, and no key opens two of them.
Each time anyone asks for data, it passes two separate checks. Both ask the same question: which company is this person from? Then only that company's records come back:
- The app adds the company to every question it asks.
- The database applies its own rule that hides every other company's records. It does this whatever the app asks for.
Checked automatically
SmartLite's automatic tests try to read and change another company's records on purpose, and fail if that ever works. They run with the database guard switched on, the same as the live system.
Who inside your company sees what #
Not everyone in your company needs to see everything. You decide, at three levels:
| Level | In plain words | Where an admin sets it |
|---|---|---|
| Profile | Which kinds of records a person can open, create, edit or delete | Setup → Profiles (Profiles & Permissions) |
| Sharing | Which of those records they see: their own, their team's, or everyone's | Setup → Sharing Rules (Sharing Rules) |
| Field security | Which details on a record they see, e.g. hide a cost or salary field | Setup → Profiles → field permissions |
The same rules apply everywhere: on screen, in reports, in exports, and when another system connects with an API key. An API key always acts as a real person, with that person's permissions.
Protected from attackers #
Keeping attackers out works in layers, like a building with a gate, a front door, locked offices and a safe. Getting past one layer doesn't open the next.
| Layer | What it means for you |
|---|---|
| Locked line | Everything between your browser or phone and SmartLite is encrypted (HTTPS), so nobody in between can read it. |
| Front door | A password policy you set, two-step sign-in with an authenticator app, single sign-on with your company's login, and an optional list of the office networks people may sign in from. After 5 wrong passwords the account is locked for a while, and every sign-in attempt is recorded. |
| Permissions | Even a signed-in person only reaches what their profile, sharing and field security allow (above). |
| Safe storage | Your data is stored encrypted by the database host. Especially sensitive fields can be encrypted a second time. Backups are encrypted and kept apart from the live system. |
| Record of changes | The audit log shows who created, changed or deleted what, and when. Sign-ins are recorded too. |
Changing your setup safely #
Mistakes in setup, like a rule that suddenly blocks everyone from saving, can hurt as much as an attack. So changes are built in a sandbox (a copy of your setup with no real records). They are tried out in a trial run, and checked against your own tests before they reach the live system.
How to Use #
1 Switch on the protections that are yours to choose #
Answering a client's questions #
Can another company on SmartLite see our data?
No. Your data is kept apart by two independent checks, one in the app and one in the database itself, and automatic tests try to break that on purpose.
Can a hacker read our data on the way?
No. Everything travels over an encrypted connection (HTTPS).
Is our data encrypted where it is stored?
Yes. The database and its backups are encrypted, and especially sensitive fields can be encrypted a second time.
What if someone steals a password?
With two-step sign-in on, a password alone isn't enough. Guessing is stopped too: 5 wrong passwords lock the account for a while. You can also limit sign-in to your office networks, and every sign-in attempt is recorded.
Can SmartLite staff see our data?
SmartLite support can sign in as one of your users to help with a problem you raise. Those sessions are recorded as support sessions, separate from your own users' sign-ins.
Who in our own company can see what?
Only what you allow: each person's profile, the sharing rules and field security decide. API keys follow the same rules as the person they belong to.
Can we get all our data out, or have it deleted?
Yes. Admins can export records (Import / Export), and the privacy tools export or erase a person's data on request.
Could an update break our setup?
Changes to your setup go through a trial run and your own tests first, and are not applied if anything fails.
Keep it accurate
Everything on this page describes how SmartLite works today. If a client needs a certification or a signed data-processing agreement, ask SmartLite for the current documents rather than promising one.