smoll Trust Center
Protecting your data and respecting your privacy are foundational to how we build, security and privacy are built in from day one.
Our Trust Center makes these commitments transparent, outlining how data is protected, where it lives, and which providers have access to it. While we work towards formal certifications such as SOC 2 and ISO 27001, we’re not waiting for a certificate to take security seriously. We’re building the controls, processes, and accountability needed to earn that trust, from the ground up.
For security inquiries, contact security@smoll.ai.
A security-first approach
Your data is yours
Isolated by design.
Your clinic and client records remain yours. Export or request deletion of your data at any time.
Each clinic operates within an isolated data environment, ensuring its records remain private and inaccessible to other clinics.
Never sold
Full transparency.
We never sell your data or share it for advertising purposes. Data is accessed only by the service providers required to operate smoll.
We identify every third-party provider that processes your data and update our disclosures before introducing new providers.
Compliance
UAE Personal Data Protection Law
Initiated
We’re aligning how we collect, store and delete personal data with the law.
GDPR
Planned
Certification is planned once our controls have run for a full period.
SOC 2 Type II
Planned
Audit planned once our controls have run for a full period.
ISO 27001
Planned
Planned after SOC 2.
Security
Encryption
Data is encrypted in transit with TLS and encrypted at rest by our infrastructure providers.
Access control
Clinic owners choose what staff can see. Our own access is limited and logged.
Payments
Card details go straight to Stripe. smoll never stores full card numbers.
Each clinic’s number routes to that clinic only, through WhatsApp’s official Business Platform.
AI features
The receptionist, scribe and triage work on a clinic’s own data. Never shared across clinics.
Subprocessors
Supabase
Database, authentication, storage
Clinic, client and patient records
Railway
Code hosting
Data in transit through our services
Stripe
Payments and payouts
Payment and business verification details
Meta
WhatsApp Business Platform
Phone numbers and message content
OpenAI
AI receptionist, scribe and triage
Message and note text sent for AI processing
Google Cloud
Cloud infrastructure services
Data processed by the Google Cloud services we use
SendGrid
Email delivery
Email addresses and email content
Twilio
SMS and phone communications
Phone numbers and message content
Framer
Public Website
Corporate and Marketing website
Questions
Who owns the data in my account?
You do. smoll processes it only to run the service you signed up for.