SmartInstruks has technical controls for authentication, access management, logging, and data minimization. At the same time, secure production use is a shared responsibility between the application, the customer, and the operations provider.
SmartInstruks does not claim ISO 27001 certification. The information below describes actual product controls and necessary clarifications prior to production use.
The production environment must use HTTPS. SmartInstruks rejects authenticated requests over unencrypted connections outside of the local development environment.
Password hashing, signed sessions in HttpOnly cookies, CSRF protection, rate limiting, and server-managed authorization reduce the risk of common attacks.
Images in the optional media library are checked on the server for permitted format, actual image content, and maximum file size prior to storage.
End users can normally read published instructions without an app, account, or registration. Name and email are only collected in features where the customer has actively configured this.
Time-limited invitations let the user choose their own password. Administrators can use TOTP-based MFA, and superadmin can make MFA mandatory for administrator roles.
Public reading without an account, configurable retention periods, and restricted access to administration.
When hosted by SmartInstruks, configured AI access is included. For self-hosting, the customer enters their own provider keys. In both models, relevant content is sent to the activated AI provider, and processing is documented for the production environment.
The customer decides what content is added and which AI features are used. Rights and the provider's processing of content must be regulated in customer and data processor agreements.
Requires provider assessment
The system maintains an audit log of, among other things, logins, MFA, user management, settings, and changes to instructions. The audit log is available to the superadmin.
Geolocation can restrict viewing based on the position reported by the browser. This is a practical supplementary measure, not a strong identity control or the sole protection for confidential content.
The backend enforces access by role, company, and department. Superadmin has system access, admin is restricted to their own company, and editor to assigned departments.
The application controls are the same, but the responsibility for the server, AI access, and technical operations depends on the chosen delivery model.
Regardless of the operating model, the customer manages users, roles, published content, information classification, and internal routines. The specific boundary of responsibility is documented in the delivery agreement.
These points should be included in the company's assessment before the solution is put into use.
Published QR content is designed for easy access. Do not put secret or sensitive information in public content. PIN and geolocation are additional measures.
The product controls support good security work, but SmartInstruks is not marketed as ISO 27001 certified or automatically "ISO-compliant".
When operated by SmartInstruks, operational responsibility is documented in the agreement. In the case of self-hosting, the customer assumes responsibility for the server, database, AI keys, backup, and updates.
We are happy to answer questions about architecture, security controls, data flow, operations, and privacy before a potential pilot.
Book a review