The SmartSuite evaluation guide

This guide gives procurement, IT, security and program teams the facts they need to include SmartSuite in an RFP, a vendor assessment or a procurement discussion. It covers what the platform is and the four solution areas it serves. It then covers how the platform is built, hosted, secured, certified, licensed and supported, and how to run an evaluation.

Every statement comes from SmartSuite's published pages, plans and Trust Center as of October 2026. Where a procurement process needs evidence, such as a SOC 2 report, a penetration test summary or a signed agreement, the guide says where to get it. For anything the guide does not cover, contact sales and the team will answer in writing.

SmartSuite Holdings, Inc. builds and operates SmartSuite, the AI-native work platform for Connected GRC. The company was founded by Jon Darbyshire, Tara Darbyshire and Peter Novosel, who helped pioneer the GRC software category after decades building enterprise workflow systems. Their founding belief is that governance should run like any other core business process, embedded in the workflows where work happens rather than managed in a separate system.

Company facts

• Headquarters: 3857 Birch Street, #945, Newport Beach, CA 92660, United States. Founded in 2021.
• Product: SmartSuite, a cloud platform (software as a service) hosted on Amazon Web Services in the United States or the European Union (Ireland).
• Customers: more than 2,000 organizations in more than 100 countries, from startups to global enterprises, including regulated industries such as financial services, healthcare and the public sector.
• Leadership: Jon Darbyshire is Chief Executive Officer. The executive team, board and investors are on the About us page.
• Board and investors: the board includes representatives of Canapi Ventures, High Alpha and Sorenson Capital, and Terry Dolce of Tenable. Investors are Canapi Ventures, High Alpha Capital and Sorenson Capital.
• Investment in the product: on average about 60% of revenue is reinvested in research and development.
• Languages: the product is localized in 16 languages with locale-aware dates, numbers and currencies (see supported languages).
• Policies and agreements: a published privacy policy, a Data Processing Agreement on request, a published subprocessor list, a formal security policy and cyber insurance.

SmartSuite is an AI-native work platform that connects the workflows that run an organization. Think of it as a work operating system: one foundation for data, automation, AI, permissions and reporting, on which purpose-built Solution Suites run. Connected GRC is the foundation. From there the platform extends across IT and service operations, project and portfolio management and business operations. A risk, a control, an incident, a project and a vendor can live in one connected system instead of five.

The problem it addresses

Most organizations run governance, risk and compliance across dozens of disconnected tools and spreadsheets, so ownership gets fuzzy, evidence is duplicated and leaders decide without a complete picture. The same pattern repeats in IT, projects and operations. The platform replaces that fragmentation with one governed environment where work, data and accountability stay linked as work moves between teams.

What that means in an evaluation

• One platform, not a bundle: every Solution Suite shares the same data model, permissions, automation, AI and reporting, so expanding into a new area does not add another system to assess.
• Productized Solution Suites: products with structure, workflow patterns, dashboards and governance built in, configured to your operating model.
• No-code configuration under IT control: process owners tailor tables, forms, layouts, dashboards and automations without code, while IT keeps permissions, audit history and administration central.
• AI inside the workflow: AI agents and assistants act within your permissions and are logged, and you choose the models.
• Enterprise security: SOC 2 Type II, ISO/IEC 27001:2022, HIPAA and GDPR audits, with single sign-on, SCIM, audit logs and a United States or European Union data center on the Enterprise and Signature plans.

How to classify it in an RFP

The platform can be evaluated as a GRC platform: enterprise risk, compliance, internal audit, third-party risk, operational resilience, privacy, AI governance, ESG, SOX, cyber and IT risk. It can equally be evaluated as an IT service management or enterprise service management platform, a project and portfolio management platform, or a work management and no-code business application platform. The same contract and the same workspace cover all four.

SmartSuite ships purpose-built Solution Suites in four solution areas. Each suite runs on the common platform and comes with the tables, relationships, workflows, automations, dashboards and permission patterns a program needs on day one. Teams typically start in one area and expand as workflows connect, on the same platform and under the same governance.

Suites, not templates

A Solution Suite is a productized solution, maintained by SmartSuite and configured to your organization's terminology, structure and approvals. It is not a static template. The platform also includes more than 200 workflow templates for teams building their own solutions, and a blank canvas for anything else. Each solution page carries a datasheet, a demo video and FAQs.

The GRC and Resilience area unifies risk, compliance, audit, third-party risk, operational resilience, business continuity, regulatory readiness, privacy, AI governance and ESG. Risks, controls, policies, obligations, audits, incidents, third parties, evidence and continuity plans connect in a single system of record. Teams get real-time visibility of exposure, control effectiveness and readiness, with full traceability for regulators, auditors and executives.

Solution Suites

• AI Governance: govern AI models and use cases with inventories, risk tiers, assessments and approvals.
• Compliance Management: centralize policies, obligations, controls, testing and evidence.
• Cyber and IT Risk: track cyber risks, vulnerabilities and security controls.
• Enterprise Risk Management: unify enterprise risks, controls, key risk indicators and mitigation actions.
• ESG Management: track ESG metrics, disclosures and audit-ready evidence.
• Internal Audit Management: plan, run and report on audits and remediation.
• Operational Resilience and Business Continuity: link critical services, business impact analyses, continuity plans and recovery.
• Privacy Management: manage data inventories, privacy assessments and requests.
• SOX Management: connect SOX controls, testing, deficiencies and certifications.
• Third Party Risk Management: assess and monitor vendor risk across the full lifecycle.

Framework coverage

The Frameworks library documents more than 300 frameworks, laws, regulations and standards and how each maps into SmartSuite workflows. It includes SOC 2, ISO/IEC 27001, NIST CSF 2.0, NIST SP 800-53, PCI DSS, CIS Controls, the CRI Profile, GDPR, HIPAA, CCPA/CPRA, SOX and EU DORA. Advisory services map your frameworks and obligations into controls and reporting during implementation, and the GRC Foundation library explains the Connected GRC operating model and implementation sequence.

The IT and Service Operations area brings structure, automation and visibility to the workflows that keep the business running: service requests, incidents, changes, assets and internal service delivery across IT, HR, facilities, finance and legal. Teams get consistent processes, SLA visibility and real-time reporting on one platform, with routing, approvals, SLAs and escalations automated. Native actions and webhooks connect the suites to ServiceNow, Jira, Slack and Microsoft Teams.

Solution Suites

• Enterprise Service Desk (ESM): standardize service requests and approvals across teams.
• IT Service Management (ITSM): manage IT requests, incidents and changes in one system.
• IT Asset Management (ITAM): track IT assets through their lifecycle.
• IT Operations Management (ITOM): coordinate operational workflows, monitoring and response.

The Project and Portfolio Management area connects project delivery to portfolio governance and strategy execution. Teams plan and execute with shared workspaces, Gantt and timeline views, real-time dashboards and automated workflows. Leaders see portfolio-level progress, risk, capacity and value from intake through delivery and benefits realization, aligned to objectives and key results.

Solution Suites

• Portfolio and Financial Management: prioritize demand, manage portfolios and track financial performance.
• Project and Program Execution: plan and execute projects and programs with consistent governance.
• Strategy and Planning: align projects and programs to strategy and OKRs and report outcomes in real time.

The Business Operations area covers the core processes that cut across teams: intake, approvals, execution and reporting for sales, marketing, product, finance, HR, legal, procurement and industry-specific workflows. Teams replace spreadsheets, email and point tools with structured workflows they can adapt without code as the business changes.

Solution Suites

• Finance Operations
• Higher Education Operations
• Legal Operations
• Marketing Operations
• People Operations
• Procurement Operations
• Product Management Operations
• Real Estate Operations
• Revenue Operations
• Sales Operations

Every Solution Suite runs on the SmartSuite platform, which is organized as eight interconnected frameworks: data architecture, workflow orchestration, automation, artificial intelligence, secure collaboration, enterprise reporting, integrations, and security and governance. The sections that follow describe each capability as an evaluator would test it; the Platform page carries the full detail, videos and FAQs.

The platform is built on a relational database foundation. Business data is structured as a connected work graph that links records, processes, teams, permissions, automation, integrations and reporting.

Building blocks

• Solutions: a secure workspace for one business process, holding its tables, views, automations and permissions. Solutions are unlimited on every plan.
• Tables: structured datasets for each entity, such as risks, controls, incidents or projects.
• Fields: 44 field types, from text, number, date and select to file, formula, lookup, rollup, linked record and SmartDoc, each with built-in validation.
• Records: the unit of work, combining structured data with comments, assignments, files and activity history.
• Views: grid, card, kanban, calendar, timeline, Gantt, map, chart and form views over the same records, with filters, grouping and sorting.
• Dashboards: widgets that combine data from any solution or table across the workspace.

Relationships and configuration

Linked records connect tables within a solution and across solutions without duplicating data, and lookups, rollups, counts and formulas derive values across those links and recalculate automatically. The formula language is designed for non-programmers, with inline help, autocomplete and syntax checking.

SmartSuite Studio is the visual builder in which process owners define data, logic, permissions and layout in one place. Record layouts use tabs and sections, display logic shows or hides fields by context, and forms capture internal and external input. Configuration is live when saved, with no build, compile or deployment step. Sandbox workspaces, available on the Enterprise and Signature plans, let teams test changes before release, and solution packaging bundles tables, automations and data into deployable packages.

Data in and out

Data imports from CSV and spreadsheet files, contacts (vCard) and calendars (ICS), or by pasting from a spreadsheet. Records export to CSV, Excel, PDF or Google Sheets, and the REST API gives programmatic access to everything. Deleted records, fields and tables are recoverable from the recycle bin, and data retention controls set archival and deletion policies. Record and attachment limits per solution scale by plan.

The automation engine runs simple record updates and multi-step processes that trigger events inside and outside the platform, without code. Every automation combines a trigger, optional trigger filters and a sequence of actions, and every run is logged with step-by-step detail.

• Triggers: record created, updated or matching a condition; form submitted; button clicked; scheduled time; email received in a connected Gmail or Outlook inbox; authenticated inbound webhook from any system.
• Trigger filters: precise conditions so an automation runs only on the records that match.
• Actions: create, update, find, merge and delete records; send email; add a comment; generate a PDF; send a webhook to any REST API; native actions for Slack, Microsoft Teams, Salesforce, Jira, Google Workspace and Microsoft 365.
• Looping: repeat actions across every related record, for example updating all controls linked to a risk.
• Conditional logic: branch a single automation by data, for example paging on-call for a P1 incident and queuing everything else for triage.
• AI Workflow Agent: an action that reads fields and attachments, follows instructions and returns structured results to later steps.

Automation access is permission-controlled: administrators restrict who builds automations, monitor runs and audit every executed action. Monthly automation runs are capped by plan: 25,000 on Team, 100,000 on Professional and 500,000 on Enterprise.

AI is built into the platform rather than added as a separate tool. It works inside records, automations, documents and the builder, every AI action runs under the user's permissions and is logged, and SmartSuite AI is included on every plan.

Capabilities

• Workflow Builder Copilot: build tables, fields and views from a plain-language description.
• AI Workflow Agents: classify, summarize, translate, generate and extract inside automations, including from PDF, Word and spreadsheet attachments.
• AI Field Agents: record-level assistants that analyze, enrich and update field values.
• SmartDoc Copilot: generate, summarize and refine text inside SmartDoc fields.
• Local and hosted MCP servers: governed, audited access for AI assistants and coding agents to SmartSuite data and actions.
• Solution Copilot and Operational Agents: announced and coming soon; see What's new for availability.

Governance and model choice

AI Admin Controls set where AI features are enabled. Customer data is never used to train external models, AI only proposes changes the user is allowed to make, and teams review AI output as part of the workflow. SmartSuite AI works out of the box with no third-party model to set up. Organizations can also bring their own model to meet model, data residency and cost requirements: OpenAI, Anthropic, Google Gemini, AWS Bedrock, Azure OpenAI, IBM watsonx, xAI, Groq, Perplexity, Nscale or a private deployment.

Reporting is built into the platform, so most teams do not need a separate business intelligence tool. The reporting engine pulls data from any solution or table across the workspace and honors every layer of access control, so users only ever see authorized records and fields, even on shared dashboards.

• Dashboards combine charts, metrics, lists and widgets from multiple solutions, with cross-report filtering and drill-down to live records. Chart types include bar, line, pie, scatter, bubble, heatmap and pivot.
• Views and dashboards update in real time as records change, and can be shared or embedded with internal and external stakeholders, including public read-only views and password-restricted sharing.
• Exports to PDF, Excel, CSV and Google Sheets provide static snapshots; the REST API feeds external tools such as Power BI when required.

Access is controlled at every level, from the workspace down to individual fields and records. Permission checks are made before data leaves the server, so fields a user cannot see are not present in the data returned to the client.

Roles and permission levels

• Workspace roles: Administrator, Solution Creator, General user and Guest. Guests see and update only what is assigned or shared to them.
• Solution permissions on every plan. Folder, view, table and field permissions, personal and locked views and advanced permission levels on Professional and above. Dynamic record permissions driven by field values, and conditional display of tabs, sections and fields, on Enterprise.
• Advanced solution permission levels: Full Access, Editor, Contributor, Assignee, Assignee+, Commenter and Viewer.
• Teams group users by role or department and carry permissions across solutions. SCIM-synced user groups keep teams aligned with the identity provider on Enterprise.

Change control and auditability

Because solutions are configuration rather than code, there is no code to version. Changes are live when saved, every structural and data change is recorded in activity history, and deleted items are recoverable from the recycle bin. Organizations that need a staging step use a sandbox workspace or a locked test solution, then copy the solution to production. Activity history is kept for one, two or three years and the recycle bin for 30, 45 or 60 days on Team, Professional and Enterprise respectively.

• In-record collaboration: comment threads, @mentions, files, approvals and assignments anchored to the record, with every change in activity history. SmartDoc fields add collaborative documents inside records.
• Notifications: in-app, email, mobile push, Slack and SMS, triggered by mentions, assignments and automation rules.
• External collaboration: guest users and shared or password-protected views give customers, vendors and auditors scoped access without full workspace membership.
• Mobile: native iOS and Android apps with the same permissions as the web app; the full web app works on tablets.
• Languages: 16 languages (English, Bulgarian, Dutch, French, German, Hindi, Italian, Japanese, Chinese (Mandarin), Polish, Portuguese, Romanian, Russian, Spanish, Swedish and Ukrainian) with localized dates, numbers and currencies; see the supported languages page.

Protecting customer data is fundamental to SmartSuite, and the platform is built for regulated environments. Security is part of the development lifecycle, from design through testing and deployment, and a formal security policy applies to all employees, partners and contractors.

Certifications, audits and attestations

• SOC 2 Type II: audited every year under the AICPA SOC 2 framework for security, availability and confidentiality. The current report is available under NDA through the Trust Center.
• ISO/IEC 27001:2022: certified information security management system. The certificate is published in the Trust Center.
• HIPAA: a formal third-party HIPAA compliance audit by Prescient Assurance. SmartSuite signs a Business Associate Agreement on the Enterprise plan.
• GDPR: a formal third-party GDPR audit by Prescient Assurance, a published privacy policy and a Data Processing Agreement on request.
• PCI DSS: the platform runs on PCI-compliant AWS infrastructure.
• Penetration testing: an independent penetration test every year, with the executive summary published in the Trust Center.
• Accessibility: a VPAT (Voluntary Product Accessibility Template, version 2.5, Section 508) is published in the Trust Center.
• Cyber insurance: a current certificate of insurance is published in the Trust Center.

The Trust Center is the self-service source for every security review: audit reports, certificates, the penetration test summary, the insurance certificate, the subprocessor list, security FAQs and system status. Request access there, or ask your account manager.

• Encryption: all traffic to and from the platform is encrypted with HTTPS (TLS), and data at rest is encrypted with AES-256. Encryption keys are managed with AWS Key Management Service.
• Data ownership: data you put into the platform belongs to you. You can export it at any time as CSV, Excel, PDF or Google Sheets, or through the REST API.
• AI and your data: customer data is never used to train external models, and AI actions are logged.
• Data loss prevention: DLP APIs on Enterprise integrate third-party services that monitor sensitive data entering and leaving the platform.
• Retention and recovery: data retention controls set archival and deletion policies; the recycle bin restores deleted solutions, tables, fields and records within the plan's window.
• Data classification: tables can be tagged to support an enterprise data classification scheme, and the tags are readable through the REST API. The platform does not identify personal data automatically; workflows can add verification and review steps where required.

• Sign-in options on every plan: email and password, and sign in with Google, Microsoft or Apple accounts.
• Two-factor authentication: on Professional and Enterprise, by text message or authenticator app.
• Single sign-on: SAML 2.0 and OpenID Connect federation with Microsoft Entra ID, Okta, Ping Federate and other identity providers on Enterprise. Administrators can require SSO for every sign-in, so the identity provider's MFA, conditional access and password policies apply.
• SCIM provisioning: automatic provisioning, attribute updates, team assignment and deprovisioning from Okta and Microsoft Entra ID on Enterprise, with SCIM-synced user groups.
• Password policy: the platform supports password strength requirements and password aging thresholds for local accounts.
• IP address restrictions: Enterprise administrators can allow access only from approved IP addresses or ranges.
• Session management: users see and end their own active sessions; administrators view login history (date, duration, IP address, location, browser, operating system and authentication method) and can terminate any session.
• API access: API tokens identify the requesting user, so every API call is subject to the same role-based permissions as the user interface.

• Activity history: every record change is logged with the time, the user or the automation that made it, the fields changed and the values before and after. Retained for one, two or three years by plan.
• Automation history: every automation run is logged with its inputs, outputs and any error condition.
• Login history, active sessions and, on Enterprise, audit logs of critical workspace events for security teams.
• Security monitoring: the platform is monitored around the clock with detection tooling, and operational logs from servers and services are held in AWS CloudWatch for analysis, alerting and investigation.
• Vulnerability management: static code analysis and dynamic application scans in the development lifecycle, and continuous infrastructure scanning with AWS GuardDuty and Inspector.
• Status page: current system status, incident history and uptime are published at status.smartsuite.com.

SmartSuite is a multi-tenant cloud platform run on Amazon Web Services, with no servers, containers or load balancers for the customer to provision or manage. Workspaces are isolated by the permission model, encryption and the platform's metadata-driven engine.

Metadata-driven engine

A solution is metadata and schema, not code. The application engine reads that metadata and creates the structures, fields, permissions and interfaces that users work with, so there is no code generation, compile or build stage. The platform does not execute customer code: the formula language is a purpose-built interpreted language, and AI actions run inside the governed automation engine. This is a deliberate isolation design for a multi-tenant service.

Components and scale

The runtime combines in-memory, NoSQL and relational data stores with a microservices layer for calculations, indexing, search, automations and import. Compute runs on AWS EC2 managed by Elastic Container Service, and worker processes scale with load. Every workspace receives platform improvements automatically. A workspace supports from one to 10,000 users, and Enterprise plans support 400,000 records and 500 GB of attachments per solution, with add-ons above that.

Data centers and residency

Customer data is processed in AWS regions in the United States and the European Union (Ireland). Enterprise and Signature customers choose where their data is hosted: a United States or a European Union data center. The primary US region is AWS US-East-2 in Ohio. The subprocessor list in the Trust Center names every third party that processes customer data and where.

• Load balancing and routing: front-end load balancers and many independent workers service requests; unhealthy nodes are detected and their work reallocated. Static assets are served through the CloudFront CDN.
• Backups: production data is backed up regularly to a separate storage location, and backups are encrypted. Customers can take their own copies at any time through export or the API.
• Disaster recovery: SmartSuite maintains a disaster recovery plan and geographically dispersed backups, with the capability to redeploy the service into other AWS regions in a catastrophic failure.
• Availability: uptime and incident history are published on the status page, and Premium Support adds priority response targets for Sev1 and Sev2 incidents with a Technical Account Manager. Uptime and support response commitments for Enterprise agreements are available from sales.

The platform is designed to connect with the systems an organization already runs, through native integrations, integration platforms (iPaaS), a REST API and webhooks. Administrators manage API keys, iPaaS connections and native integration actions centrally.

Native integrations

Built-in actions and connectors cover Slack, Microsoft Teams, Gmail and Outlook, Google Calendar, Drive, Sheets and Maps, Salesforce, HubSpot, Jira Cloud, Intercom, Twilio, Box, Dropbox and OneDrive. Front-end builders such as Softr, Noloco and WeWeb use SmartSuite as a backend for customer and partner portals. The Integrations page lists every connector by category.

Integration platforms

Make, Zapier, Microsoft Power Automate, Workato, Relay, Integrately, Bardeen and Ply connect the platform to more than a thousand other applications for multi-step, cross-system flows without code.

REST API and webhooks

The documented REST API at developers.smartsuite.com provides create, read, update and delete endpoints with authentication and pagination for records, schema and files. Inbound webhooks start automations from external events, and outbound webhooks send structured payloads to any system, such as ServiceNow. API calls and automation runs share plan-based monthly limits (25,000 on Team, 100,000 on Professional, 500,000 on Enterprise) with throttling, monitoring and alerts. API tokens carry the user's permissions. SCIM, SAML and OIDC connect the platform to Okta, Microsoft Entra ID and Ping Federate, and DLP APIs connect third-party data protection services.

Most teams can deploy a Solution Suite in days or weeks, depending on complexity, and begin building on day one. SmartSuite Services combine in-house experts with certified partners to support every stage, from onboarding to enterprise programs. Services are optional and scoped separately from the subscription; the Services page carries the full description and a datasheet.

Services

• Onboarding: a structured four-week program that configures your first one or two Solutions, views, dashboards and starter automations, sets up roles and access (including SSO and SCIM where the plan supports them) and trains your first teams. Starter, Growth and Enterprise packages scale the scope.
• Advisory and implementation: Strategy Roadmap engagements, Framework and Regulatory Alignment (for example SOC 2, NIST CSF, the CRI Profile and DORA), Solution Launch Packs, and integration and migration services.
• Managed services: Expert on Demand, an Enterprise add-on that provides a set number of expert hours each month over a 12-month term to extend workflows, add solutions, maintain integrations and advise on new features.
• Premium Support: an Enterprise add-on with priority response targets for Sev1 and Sev2 incidents, a named Technical Account Manager, release and upgrade guidance and executive escalation.
• Customer success: Enterprise plans on an annual term with 25 or more licensed users include a named Customer Success Manager.

Standard support on every plan

Every plan includes the Help Center, real-time chat with the support team from inside the product, onboarding guides and getting-started videos. It also includes daily office hours with an onboarding specialist (weekdays at 9 am Pacific), getting-started workshops every two weeks, monthly training with a free certification exam, on-demand webinars, SmartSuite Academy and the user community.

• SmartSuite Academy: free self-paced courses and certifications at academy.smartsuite.com, from fundamentals to building and administering solutions.
• Live training: a monthly two-part class (platform fundamentals, then building solutions) followed by a free live certification exam; private enterprise sessions, admin tracks and GRC program workshops through Training and Enablement services.
• Help Center: searchable documentation, step-by-step guides and videos at help.smartsuite.com, available inside the product.
• Community: partners, power users and SmartSuite staff answer questions at community.smartsuite.com.

SmartSuite works with a global network of consulting firms, system integrators, resellers, technology partners and managed service providers, with a focus on North America and EMEA. Partner programs cover reselling, implementation and advisory services, certified integrations, referrals and managed services such as GRC-as-a-service. Implementations can be SmartSuite-led, partner-led or co-delivered. Use the partner directory to find a vetted partner for your region and industry.

SmartSuite is licensed per seat on the Team, Professional and Enterprise plans, with a per-solution Signature plan for large deployments. You pay for users with edit permissions; read-only users, commenters and people submitting forms are free, and changes are prorated. Full plan detail and a feature comparison are on the Pricing page.

Plans

• Team: $15 per seat per month billed annually ($20 billed monthly), minimum 3 billable users. Unlimited solutions, 5,000 records and 50 GB of attachments per solution, 25,000 automation runs and API calls per month, 30-day recycle bin, one year of activity history, SmartSuite AI.
• Professional: $32 per seat per month billed annually ($36 billed monthly), minimum 5 billable users. 100,000 records and 100 GB per solution, 100,000 runs and calls per month, 45-day recycle bin, two years of activity history, plus folders, Gmail and Outlook integration, two-factor authentication and advanced permissions.
• Enterprise: custom pricing, no minimum. 400,000 records and 500 GB per solution, 500,000 runs and calls per month, 60-day recycle bin, three years of activity history. Adds SSO, SCIM provisioning and SCIM-synced groups, audit logs, IP address restrictions, data loss prevention, European data residency, dynamic record permissions, conditional display, a Customer Success Manager, professional services and payment by invoice. Premium Support and Expert on Demand are add-ons.
• Signature: priced per solution rather than per user, for organizations licensing one or more solutions such as GRC, ITSM or procurement for hundreds or thousands of users. It pairs the Enterprise platform with governance and support arrangements agreed in the contract.

Commercial terms

• Trial: a 14-day free trial of the Professional plan with your real workflows, no credit card and no automatic charge; up to 50 people can join.
• Billing: every plan can be paid by credit card. Enterprise plans that meet a minimum fee can be billed annually by invoice, with payment by ACH, wire transfer or company check.
• Changes: plans and user counts can be changed at any time; cancellation takes effect at the end of the current billing cycle. When a record or attachment limit is reached, solutions keep working and data stays in place until the plan is upgraded.
• Agreements: a Data Processing Agreement, a HIPAA Business Associate Agreement (Enterprise plan) and a mutual NDA for audit reports are available through sales and the Trust Center.

Product and company

• Platform: the eight frameworks, with videos and FAQs. Solutions: the four areas and every Solution Suite, each with a datasheet and demo. Demo library: short on-demand videos.
• Customer stories: published case studies, including MediaLab 3D Solutions, Progettiamo Autonomia and MGT (Layer3 Communications). Ask sales about reference customers in your industry.
• About us: company story, leadership, board and investors. What's new: the release log, with plan availability.

Security and legal

• Trust Center: audit reports, certificates, penetration test summary, insurance, subprocessors and security FAQs.
• Security overview and vulnerability reporting; status page for live system status and uptime; privacy policy.

Commercial and support

• Pricing: plans, limits, the full feature comparison and billing FAQs. Services: onboarding, advisory, managed services, training and Premium Support. Partners: programs and directory.
• Help Center, developer documentation, SmartSuite Academy and the community.
• Frameworks library and GRC Foundation: reference material for GRC programs.

A SmartSuite evaluation usually runs in five steps and takes days or weeks rather than months. The sales team supports each step; send RFPs and security questionnaires to sales for a written response.

• Define the scope: the solution area, the one or two workflows that matter most, your must-have requirements, and the systems and identity provider the platform has to work with.
• Collect the evidence: request Trust Center access for the SOC 2 report, the ISO/IEC 27001 certificate, the penetration test summary, the HIPAA and GDPR reports and the subprocessor list; ask sales for the DPA, the BAA (Enterprise) and sample agreements.
• See it and try it: schedule a demo built around your workflows, then start the 14-day free trial of the Professional plan, or ask sales about an Enterprise evaluation when the pilot needs SSO, SCIM or EU data residency.
• Run a pilot: deploy the relevant Solution Suite on your chosen workflows with real data and users, configure it to your terminology and approvals, connect one or two integrations, and measure against your requirements.
• Agree the commercials: choose the plan (per seat, or Signature per solution), the services package and any add-ons, and finalize terms with sales.

Contact sales to start, or to send an RFP. For partner-led evaluations, use the partner directory.