// Trust & Security Report
Smartsheet
Work management and collaboration platform; includes Smartsheet (sheets, dashboards, forms, automation, AI), Smartsheet Gov (FedRAMP/IL4-authorized variant for US federal agencies), and Advanced Work Management (enterprise PPM tier)
Certifications held
10
Maturity
Enterprise
Trains on your data
No
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on smartsheet.com“Governance request form Questions about Service Organization Controls What is a SOC2 Report? How can I get copies of the SOC reports? ‹ Back to Compliance Have questions? Contact us Smartsheet PRODUCT O”
Verify on smartsheet.com“SOC 3 is an abbreviated version of the SOC 2 Type 2 audit report and is publicly available.”
Verify on smartsheet.com“ISO/IEC 27017:2015 - Code of practice for information security controls based on ISO/IEC 27002 for cloud services”
Verify on smartsheet.com“Built a strong privacy program by establishing and maintaining a Privacy Information Management System (PIMS) by implementing data privacy specific requirements and controls in accordance with the requirements of both ISO 27018:2019 and ISO 27701:2019 standards”
Verify on smartsheet.com“IEC 27001:2022? What is ISO/IEC 27017:2017? What is ISO/IEC 27018:2019? What is ISO/IEC 27701:2019? What is ISO/IEC 22301:2019? How can I get copies of the ISO Certifications? ‹ Back to Compliance Have questions”
Verify on smartsheet.com“language Open search Log in Open navigation Breadcrumb Trust Center Compliance FedRAMP The Federal Risk and Authorization Management Program (FedRAMP) was established in 2011 to provide a cost-effective, ri”
Verify on smartsheet.com“Smartsheet Gov also received Impact Level 4 (IL-4) authorization from the Defense Information Systems Agency (DISA). [NOTE: Applies to Smartsheet Gov only, not the standard commercial product.]”
Verify on help.smartsheet.com“All the information provided in this article is for you to review as part of your own HIPAA compliance efforts.”
Verify on smartsheet.com“Smartsheet is built around international privacy standards including GDPR and CCPA, so you stay in control of how your data is handled.”
> Show 3 unconfirmed / not-held certifications
source: smartsheet.comSmartsheet does not intend the use of the Offerings to be in compliance with the Payment Card Industry Security Standards. [PCI DSS is explicitly out of scope per vendor statement; third-party plugins marketed for PCI workflows are customer-side tools, not Smartsheet platform certification.]
source: smartsheet.comA CAIQ self-assessment (CSA STAR Level 1) is available as part of Smartsheet's security pack upon request but is not publicly registered on the CSA STAR registry with confirmed status. No evidence of Level 2 CSA STAR Attestation or Certification found on vendor domain.
source: smartsheet.comNo public evidence of ISO/IEC 42001 certification found on vendor domain or trust center as of June 2026.
// Privacy & AI training
Trains on customer data
No
Data processing agreement
Offered
Data region
US (default, smartsheet.com), EU-Germany with backup in Ireland (smartsheet.eu), Australia (smartsheet.au). Usage data and account metadata are transferred to US regardless of region choice. Staff worldwide may access data for support and security purposes.
Explicitly stated in privacy FAQs: 'We do not own your AI Data and do not use it to train public models.' Smartsheet made a deliberate architectural decision not to use customer content to train third-party foundational models, even in aggregate. Enterprise contracts with AI providers include explicit prohibitions on using customer data for model training. Input prompts and AI outputs are deleted within 180 days of contract termination.
// Security controls
Penetration testing
Annual third-party penetration testing; reports available to customers upon written request under NDA
smartsheet.comAccess controls
Unique IDs per employee, least privilege, 90-day access review cycles, MFA/VPN for remote access, account lockout enforced
smartsheet.comSecurity incident response
Written breach notification to customers without undue delay upon confirmed Security Breach; formal Breach Management program
smartsheet.comDisaster recovery
Annual DR program testing; N+1 redundant data center requirements for IaaS providers; routine backup validation
smartsheet.com// Products & data scope
Data it handles: Customer content (sheets, attachments, forms, automations); PHI allowed only on Enterprise plan with BAA
SOC 2 Type 2, ISO 27001/17/18/701 certified. HIPAA requires Enterprise plan plus BAA. FedRAMP and DOD IL4 do NOT apply to this product. Data residency options: US, EU, AU.
Data it handles: US federal government customer data; hosted on AWS GovCloud (US)
FedRAMP Moderate ATO and DISA IL4 PA. Separate product from standard Smartsheet. Used by NIH, National Parks Service, Library of Congress.
Data it handles: Same as commercial Smartsheet; AI processes customer data within customer's permission model only
Customer data is not used to train public AI models. Contractual prohibitions on third-party LLM providers using customer data for training. AI operates within existing sheet-level permissions.
Data it handles: Same as commercial Smartsheet enterprise tier
Enterprise-tier add-on. Included in same SOC 2 and ISO audit scope as core platform.
// What to watch
- ISO 27001 VERSION (RESOLVED): The trust/compliance/iso page text still reads 'ISO/IEC 27001:2013', but the vendor's own certificate page (https://www.smartsheet.com/smartsheet-iso-27001-certificate) confirms the current issued certificate is ISO/IEC 27001:2022, issued Feb 27, 2024, valid until Feb 26, 2027, by EY CertifyPoint. The compliance-page text is outdated; the :2022 certificate is current and authoritative.
- FedRAMP Moderate and DOD IL4 authorizations apply only to Smartsheet Gov, a separate product hosted on AWS GovCloud. The standard commercial Smartsheet product does not carry these authorizations. Buyers in regulated sectors must confirm which product they are procuring.
- HIPAA compliance (PHI Eligible Services plus a BAA) is restricted to Enterprise plan customers only; Pro and Business plan users cannot upload PHI. Confirm the plan tier before handling PHI in Smartsheet.
- Smartsheet has stated that PCI DSS is explicitly out of scope: 'Smartsheet does not intend the use of the Offerings to be in compliance with the Payment Card Industry Security Standards.' Any payment card data processing must not use Smartsheet as the compliant store-of-record.
- There is no evidence of ISO/IEC 42001 (AI Management System) certification as of June 2026, despite Smartsheet's active AI feature development.
- Smartsheet's security pack may include a completed CAIQ questionnaire, but no confirmed public CSA STAR registry listing (Level 1 or Level 2) was found on the vendor domain or in the CSA registry.
// At a glance
Pricing model
Freemium / per-seat subscription (Pro, Business, Enterprise tiers); Advanced Work Management as enterprise add-on; Smartsheet Gov requires separate procurement via channels like Carahsoft
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Smartsheet Inc.'s own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-06-29. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
smartsheet.com// Trust reports for comparable tools
Other tools in the same category, each with its own sourced report.