// Trust & Security Report
Smartsheet AI
by Smartsheet Inc.
Smartsheet AI: AI-powered collaborative work management platform including Smart Assist (in-product AI companion), Smart Columns (AI-enriched data at scale), AI Dashboard Builder, Natural Language Creation, MCP Connectors for third-party AI tools (Claude, Copilot, Gemini, ChatGPT), and Smart Agents (coming soon).
Certifications held
10
Maturity
Enterprise
Trains on your data
No
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on smartsheet.com“Governance request form Questions about Service Organization Controls What is a SOC2 Report? How can I get copies of the SOC reports? ‹ Back to Compliance Have questions? Contact us Smartsheet PRODUCT O”
Verify on smartsheet.com“ISO/IEC 27001:2022 - Information Security Management”
Verify on smartsheet.com“ISO/IEC 27017:2015 - Code of practice for information security controls based on ISO/IEC 27002 for cloud services”
Verify on smartsheet.com“Built a strong privacy program by establishing and maintaining a Privacy Information Management System (PIMS) by implementing data privacy specific requirements and controls in accordance with the requirements of both ISO 27018:2019 and ISO 27701:2019 standards”
Verify on smartsheet.com“IEC 27001:2022? What is ISO/IEC 27017:2017? What is ISO/IEC 27018:2019? What is ISO/IEC 27701:2019? What is ISO/IEC 22301:2019? How can I get copies of the ISO Certifications? ‹ Back to Compliance Have questions”
Verify on help.smartsheet.com“All the information provided in this article is for you to review as part of your own HIPAA compliance efforts.”
Verify on smartsheet.com“language Open search Log in Open navigation Breadcrumb Trust Center Compliance FedRAMP The Federal Risk and Authorization Management Program (FedRAMP) was established in 2011 to provide a cost-effective, ri”
Verify on smartsheet.com“Smartsheet Gov has been granted Impact Level 4 (IL-4) PA by the Defense Information Systems Agency (DISA).”
Verify on smartsheet.com“Smartsheet is built around international privacy standards including GDPR and CCPA, so you stay in control of how your data is handled.”
> Show 3 unconfirmed / not-held certifications
source: smartsheet.comSmartsheet is actively pursuing ISO 42001 certification and is planning for compliance with the EU AI Act. Not yet certified as of 2026-06-27.
source: smartsheet.comSmartsheet does not intend the use of the Offerings to be in compliance with the Payment Card Industry Security Standards. Explicitly excluded in the Acceptable Use Policy.
source: smartsheet.comNo public evidence of CSA STAR registration or self-assessment found on vendor domain or CSA STAR Registry as of 2026-06-27.
// Privacy & AI training
Trains on customer data
No
Data processing agreement
Offered
Data region
Three residency options per vendor data-residency docs: United States (backed up in the US), European Union (Germany, backed up in Ireland), and Australia (backed up in Australia). Region is determined at account creation via the regional login domain (smartsheet.com / smartsheet.eu / smartsheet.au). Specific AWS region names are not published by the vendor.
Contractual guarantee per AI page and Privacy FAQ: 'Your data never trains third-party foundation models, never mixes with other customers' data, and never leaves your control. This isn't just policy - it's a contractual guarantee.' Privacy FAQ confirms: 'No. We do not own your AI Data and do not use it to train public models.'
// Security controls
Encryption in transit
TLS required for all connections; only encrypted connections to the online Service permitted for transfer of Customer Content.
smartsheet.comEncryption at rest
All Customer Content stored in encrypted form at rest within the online Services. Standards consistent with or exceeding NIST recommendations.
smartsheet.comAccess controls
Unique IDs per employee, principle of least privilege, 90-day access review cycles, account lockout on repeated failed attempts, MFA required for remote/VPN access.
smartsheet.comPenetration testing
Annual external penetration testing by independent third-party security professionals. Pen Test Reports available to customers on written request.
smartsheet.comBreach notification
Notification within 72 hours of confirming a Security Breach. Subprocessor notice period: 15 days advance notice.
smartsheet.comVulnerability / patch management
Ongoing programs to keep systems updated with latest patches, updates, and bug fixes. Anti-malware deployed and kept current.
smartsheet.comAI architecture
Each AI request routes through Smartsheet's application layer to the model provider; no customer data retained by the AI model provider at any point. Usage logged separately for admin audit without exposing data to model partners. AWS used as cloud infrastructure partner for AI.
smartsheet.comAI access controls
Admins control which AI features are enabled and for which users. User permissions enforced: if a user cannot access a sheet, the AI cannot either.
smartsheet.comInfrastructure
Hosted on AWS. Smartsheet Gov on AWS GovCloud (US). EU region on AWS Frankfurt/Dublin. Disaster recovery program with annual testing.
smartsheet.com// Products & data scope
Data it handles: Sheets, dashboards, reports, attachments, automations, AI-enriched columns. Data hosted in US, EU, or AU based on account region.
Pro, Business, Enterprise tiers. HIPAA BAA available at Enterprise only. AI features availability varies by plan - may require add-on or Enterprise tier.
Data it handles: CUI and government data. Hosted on AWS GovCloud (US). Separate instance from commercial.
FedRAMP Moderate ATO, DOD IL4 PA. Used by NIH, NPS, Library of Congress, VA. Separate product from commercial Smartsheet.
Data it handles: Reads sheet data, project context, permissions enforced. No customer data retained by model provider.
Built into Smartsheet platform. AI model provider not publicly named (AWS partnership noted). Customer data never trains third-party models.
Data it handles: Exposes live Smartsheet work data to third-party AI tools (Claude, Copilot, Gemini, ChatGPT) in real time via MCP protocol.
Data filtering/compression applied before reaching third-party AI. Same compliance posture as core platform per vendor claims.
Data it handles: Project monitoring, risk surfacing, workflow execution. Human-in-the-loop approval built in.
Announced as 'coming soon' as of 2026-06-27. Not yet generally available.
// What to watch
- Smartsheet states it is actively pursuing ISO 42001 certification on its Responsible AI page but is not yet certified. The AI homepage lists 'SOC 2, GDPR, data residency' alongside AI trust statements, which could be read as implying broader AI-governance certification than currently held.
- HIPAA BAA is available for Enterprise plans covering the core Smartsheet platform (PHI Eligible Services). It is not publicly documented whether Smartsheet AI features (Smart Assist, MCP Server) are included in HIPAA BAA scope. Healthcare customers using PHI with AI features should confirm coverage before enabling AI capabilities.
- The MCP Server routes live Smartsheet data to third-party AI models (Claude, Copilot, Gemini, ChatGPT). Smartsheet states data is filtered/compressed before reaching the model and no data is retained by providers. Security of the third-party model provider interaction is a shared-responsibility consideration that customers should review for their specific AI tool integrations.
- The vendor's ISO compliance page lists ISO/IEC 27001:2013, not the 2022 revision. The 2026-03 security capabilities whitepaper references ISO 27001 without a year. ISO 27017:2015 is corroborated on the ISO compliance page and in the same whitepaper ('ISO/IEC 27001, 27017, & 27018').
- Smart Agents are listed as 'coming soon' on the AI page and are not yet generally available.
// At a glance
Pricing model
Freemium with tiered subscriptions (Pro, Business, Enterprise, Advanced Work Management). AI features may require Enterprise tier or add-on. Smartsheet Gov is a separate government SKU.
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Smartsheet Inc.'s own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-06-27. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
smartsheet.com// Trust reports for comparable tools
Other tools in the same category, each with its own sourced report.