Security and compliance

Smart supplies technology for the water service, a critical sector. That is why our website is also designed to expose as little as possible.

Static site, no CMS

Pages are static files: no WordPress, plugins or online database to keep updated and to attack.

No third-party scripts

Fonts, images and scripts are served from our own domain. No trackers, no external statistics, no profiling cookies.

Encrypted connections

The site is only reachable over HTTPS, with HSTS to prevent downgrade to unencrypted connections.

Security headers

Restrictive Content Security Policy, clickjacking protection, content-sniffing block, Referrer-Policy and Permissions-Policy limited to what is needed.

Protected forms

Server-side validation, rate limiting, origin check, maximum field lengths and no user data used in email headers. We do not store requests on the web server: they are only sent by email.

Minimal data

We collect only what is needed to reply. Details in the privacy notice.

Support for customers subject to the NIS2 Directive

Many of our customers, such as water utilities, are subject to the NIS2 Directive (in Italy Legislative Decree 138/2024) and must assess the security of their suppliers. On request we provide the information useful for these assessments about the products and services we supply to you.

Write to info@smaart.it stating your organisation and the product or service concerned.

Report a vulnerability or an incident

If you found a vulnerability on the site or in one of our products or services, or want to report a security incident, write to us. We review every report.

What we commit to:

  • acknowledging receipt within 5 working days;
  • keeping you informed about the assessment and the fix;
  • not taking legal action against anyone acting in good faith and following these rules.

What we ask of you:

  • do not access, change or copy data that is not yours beyond what is needed to show the problem;
  • do not carry out denial-of-service attacks, social engineering or physical tests;
  • do not disclose the vulnerability before it is fixed, agreeing the timing with us.

You can write to info@smaart.it or use the form below. The security.txt file is available at /.well-known/security.txt.

What we do not claim

This page describes the site’s technical measures. It is not a certification or an attestation of compliance with any law or standard.