FAQ

Frequently asked questions

Data residency

Where is my data stored? Core persistent customer data is hosted in Azure UK regions. See Data Residency.

Can I choose a different region? GoSmarter follows a standard hosted model. Region options can be discussed as part of enterprise scoping.

Does any data leave the UK? Some supporting processing may use EU regions where required by platform capability. Two sub-processors are the exception to UK/EU-only: Clerk (identity/authentication) and Stripe (billing) both transfer data to the United States under Standard Contractual Clauses and/or the Data Privacy Framework. See Data Residency for detail.

Is my data subject to US law / the CLOUD Act? GoSmarter is delivered on Microsoft Azure under Microsoft’s contractual and compliance framework. Data residency and transfer controls are documented in Data Residency.

AI and document processing

Does GoSmarter use AI? Yes. AI is used for defined document-processing tasks. Non-AI algorithmic processing is also used where appropriate. See AI Security.

Is my data used to train AI models? Not by Microsoft — they contractually commit that your data is not used to train, retrain, or improve their AI models (see Microsoft’s data privacy commitments). GoSmarter does use uploaded documents to continuously improve our own classification and extraction models; this data is never shared with Microsoft, other AI providers, or other customers. See AI Security for the full explanation. No opt-out from this is currently available.

What AI services does GoSmarter use? GoSmarter uses Microsoft Azure AI services appropriate to the workload. Service-level and regional details can be shared under NDA during a security review.

Does the optimisation solver use AI? No. The cutting optimisation service is a pure algorithmic solver using heuristic and genetic algorithm techniques. It makes no external AI or API calls.

Authentication and access

How do users sign in? Via GoSmarter’s Clerk identity platform. See Access Control for supported sign-in methods.

Does GoSmarter support MFA? Yes, via an authenticator app or backup codes. It’s opt-in per user and not currently required at sign-in or sign-up. See Access Control.

Can a user in Company A see Company B’s data? No. Every API request validates the authenticated user’s company membership against a dedicated database record. Requests for companies the user doesn’t belong to are rejected.

Encryption

Is data encrypted at rest? Yes. AES-256 encryption on all storage (Azure SQL with TDE, Blob Storage with SSE, Key Vault).

Is data encrypted in transit? Yes. TLS 1.2 minimum enforced on all services. HTTP connections are rejected.

Can I bring my own encryption keys? Not currently. All encryption uses platform-managed keys. Customer-managed keys (BYOK/CMK) are not available.

Infrastructure

Do you use shared or dedicated infrastructure? GoSmarter runs on managed Azure platform services with isolation controls between workloads.

Is there a public status page? Service status and incident communications are handled through customer support and account channels.

What is your uptime SLA? Availability commitments are provided contractually based on your service agreement.

Billing and subscriptions

How does pricing work? GoSmarter uses tiered plans (Starter, Workshop, Production, Scale), each with a monthly allowance of AI processing credits used for mill certificate classification and extraction. You can start on a free trial without a card.

Can I try GoSmarter before paying? Yes. A free trial is available with no card required upfront.

What happens if I use more AI processing than my plan allows? You can purchase additional credit top-ups on top of your plan’s monthly allowance.

Can I change or cancel my plan? Yes, self-service. Upgrades take effect immediately; downgrades and cancellations are scheduled for the end of the current billing cycle so you keep what you’ve already paid for.

Where do I manage payment methods and invoices? Through the self-serve billing portal, powered by our billing sub-processor Stripe.

Does GoSmarter store my card details? No. Payment instruments are collected and stored directly by Stripe. See Access Control and Privacy for how Stripe is used as a sub-processor.

Compliance

Do you have SOC 2 Type II? GoSmarter runs on Azure, which maintains SOC 2 Type II attestation for relevant platform services. Azure reports are available via the Microsoft Service Trust Portal.

Do you have ISO 27001? Azure maintains ISO 27001 certification for relevant platform services. See Certifications.

Do you conduct penetration testing? Security testing is performed as part of our security programme. High-level outcomes and evidence can be shared under NDA where appropriate.

Can I get a copy of your DPA? Yes. DPA information is available on request.

Can we get detailed architecture and control evidence? Yes. Detailed technical documentation and assurance artefacts are available under mutual NDA.

Still have questions?

Email us, contact us online, or book a compliance call to request the NDA pack.