Hey guys, great questions! As Jon mentioned on that webinar we do indeed use Amazon AWS for our services and data storage. A little bit more granularity:

All internal SmartSuite data transits exclusively through internal AWS VPCs without any connection to Internet. All external data is SSL encrypted, and we use the latest AWS SSL security policies. All data at rest is encrypted with AWS KMS keys generated for our account. We additionally use security tools to scan the service to detect any potential issues.

Access to SmartSuite data for our internal staff can only be made via a \"bastion host\" protected with AWS IAM policies and one time SSH keys. The list of individuals who can access the environment is extremely limited and must be approved by myself (CTO) and Jon (CEO). We have an ongoing security training process for our software engineers, and incorporate security best practices into our software development lifecycle.

We have also implemented a role-based access control mechanism within the product itself, giving you the ability to restrict access to sensitive data within the product. Keep an eye out for our upcoming release of field-level permissions, which allow you to control access all the way down to that level of granularity (hiding salary data, SSNs etc from staff not authorized to access it for example).

While we don't bill SmartSuite specifically as a password \"vault\" or storage mechanism, we're certainly employing security measures that anticipate the storage of highly sensitive information, and feel confident that we have achieved that. We currently have customers that entrust sensitive business information, financial data, investment details and the like to SmartSuite.

I hope that helps you feel confident about storing your business information in SmartSuite. As always I welcome feedback and additional questions if you have them.

Is it a good or common practice to store sensitive data?