Purpose. This Security Schedule describes the baseline technical and organisational security measures SmartDry maintains for the Services and for Customer Data processed under the Agreement. It is intended to provide a durable contractual security baseline while allowing SmartDry to improve the underlying implementation as its architecture evolves.
Important: This Schedule does not state or imply that SmartDry holds ISO 27001, SOC 2, PCI DSS or another certification unless SmartDry expressly confirms that certification in writing. Security obligations are risk-based and subject to the Agreement, the DPA and applicable law.
| Security principle | SmartDry applies security measures proportionate to the nature, scope, context and purposes of processing and the likelihood and severity of risks to confidentiality, integrity, availability and resilience. |
|---|
1. Status and Relationship to the Agreement
This Security Schedule forms part of the Agreement where it is identified in an Order Form, contracting record or onboarding record in accordance with the SmartDry Master Software & Services Terms ("Master Terms").
Capitalised terms not defined in this Security Schedule have the meanings given in the Master Terms or, for data-protection matters, the SmartDry Data Processing Agreement ("DPA").
Where this Security Schedule addresses the protection of Customer Personal Data processed by SmartDry as Processor, it supplements the DPA. If there is a direct conflict concerning such processing, the DPA prevails in accordance with the order-of-precedence provisions of the Agreement. A more specific or more protective security control in this Schedule does not constitute a conflict merely because the DPA states a broader obligation.
2. Scope
This Schedule applies to the SmartDry-hosted Services and the systems, personnel and suppliers used by SmartDry to provide those Services, to the extent they store, transmit, access or otherwise process Customer Data.
Depending on the Customer's subscription, this may include SmartDry POS, Dashboard, TDS, Driver, Dispatch, Connect, customer and order management, garment-passport and imaging functionality, barcode/RFID workflows, customer portals, APIs, administrative applications and related hosted services.
Customer-controlled devices, networks, accounts, third-party integrations and physical premises remain subject to the Customer responsibilities in this Schedule and the Agreement.
3. Security Standard and Risk Management
SmartDry will maintain technical and organisational measures designed to provide a level of security appropriate to the risks presented by the Services and the Customer Data processed through them. In selecting and maintaining measures, SmartDry will take account of factors including the state of the art, implementation cost, the nature and sensitivity of data, processing context, service architecture and reasonably foreseeable threats.
SmartDry's security programme is intended to support the core security outcomes of:
- managing and reducing security risk;
- protecting Customer Data and systems against unauthorised access, unlawful processing, accidental loss, alteration or destruction;
- detecting and investigating material security events; and
- minimising the impact of incidents and restoring service availability where reasonably practicable.
No security programme can eliminate all risk. SmartDry does not warrant that the Services are immune from every attack, vulnerability or security incident, but will maintain the measures and processes described in this Schedule subject to the limitations of the Agreement.
4. Security Governance and Ownership
SmartDry will assign responsibility for security-relevant engineering, operational and incident-management activities to appropriate personnel. Security responsibilities may be distributed across engineering, infrastructure, operations, support and management according to role.
SmartDry will maintain proportionate processes to:
- identify material risks to production systems and Customer Data;
- review security-relevant changes and significant incidents;
- maintain security-related documentation and operational runbooks appropriate to the maturity and risk of the Services;
- track material remediation actions; and
- review the appropriateness of controls as the platform, threat environment and legal requirements evolve.
5. Identity, Authentication and Access Control
5.1 Customer and user access
SmartDry will use authentication and authorisation controls appropriate to the relevant application and user role. Access to Customer Data is designed to be restricted to authorised identities and permitted tenant, location, role or functional scope.
Where supported by the relevant SmartDry application, SmartDry will use role-based or function-based permissions to distinguish administrative, operational and ordinary-user capabilities.
5.2 Privileged SmartDry access
SmartDry will restrict privileged production, support and administrative access to personnel with a legitimate business need and will apply least-privilege principles appropriate to the relevant function.
- Privileged access is limited to authorised personnel and is not intended for routine use by personnel who do not require it.
- Access rights are reviewed, removed or adjusted when personnel change role or no longer require the relevant access.
- SmartDry will use multi-factor authentication for privileged access to critical third-party administrative systems where the relevant service supports it and it is reasonably practicable to do so.
- Support or administrative access to a Customer environment must be connected to an authorised operational, support, security, legal or engineering purpose.
5.3 Service identities
Service accounts, API credentials and machine identities will be scoped and protected according to their function. Highly privileged service credentials will not intentionally be exposed in public client-side applications.
6. Tenant Isolation and Database Security
SmartDry uses a multi-tenant architecture for parts of the Services. SmartDry will maintain logical controls designed to prevent one Customer from obtaining unauthorised access to another Customer's data.
Controls may include, according to the relevant data store and service:
- tenant, business and location identifiers carried through application and database access paths;
- database Row Level Security (RLS), forced RLS or equivalent tenant-scoping controls where appropriate;
- server-side authorisation checks for privileged or cross-tenant operations;
- role and staff-to-business assignment controls for authorised internal operational access;
- UUIDs or equivalent identifiers and scoped queries designed to reduce accidental cross-tenant access; and
- fail-closed access patterns where data stores are not intended to expose records until an appropriate access policy is present.
SmartDry may use different technical mechanisms where a particular storage technology does not support RLS, provided an equivalent logical isolation objective is maintained.
7. Secrets, Keys and Credential Protection
SmartDry will maintain processes designed to prevent sensitive production secrets from being intentionally embedded in public source code or client-side application bundles.
Baseline controls include, where applicable:
- server-side storage of privileged database/service credentials;
- restricted environment or secrets-management mechanisms for production secrets;
- automated repository or CI checks intended to detect prohibited privileged-key patterns in client-facing source code;
- secret-scanning controls within the software development lifecycle;
- restricted access to production credentials based on operational need; and
- credential rotation or revocation where SmartDry reasonably suspects a material secret has been compromised.
SmartDry will not knowingly place Supabase service-role credentials, payment-provider secret keys or comparable privileged production secrets into browser-delivered or public mobile client source code.
8. Encryption and Network Protection
8.1 Data in transit
SmartDry will use industry-standard encrypted transport for supported production connections carrying Customer Data over public networks, including HTTPS/TLS for internet-facing web and API traffic where applicable.
8.2 Data at rest
SmartDry will use encryption at rest or equivalent storage protections provided by its managed infrastructure and data-storage providers where applicable to the relevant service. Additional application-level encryption may be used where SmartDry determines it is appropriate to the risk.
8.3 Network and edge controls
SmartDry may use reverse proxies, content-delivery networks, edge-security services, network segmentation, managed cloud controls, traffic filtering or related mechanisms to reduce exposure of production services and route traffic securely.
Specific vendors, network topology and cryptographic implementations may change over time and are not fixed by this Schedule, provided the overall level of protection is not materially reduced contrary to Section 22.
9. Application and API Security
SmartDry will maintain application and API controls designed to reduce unauthorised access and common implementation risks, including appropriate input validation, authentication and authorisation at relevant trust boundaries.
Where applicable, SmartDry will use:
- server-side permission checks for sensitive operations;
- tenant-aware request and data-access boundaries;
- idempotency controls for sensitive workflows where duplicate processing could create operational or financial risk;
- segregation of privileged operational capabilities from ordinary Customer permissions;
- rate, abuse or traffic controls where appropriate to protect service availability and integrity; and
- secure defaults and fail-safe behaviour where reasonably practicable.
10. Secure Software Development and Change Management
SmartDry will maintain a controlled software-development lifecycle proportionate to the maturity and risk of the Services.
Relevant measures may include:
- controlled source-code repositories and branch/change-management practices;
- peer review, automated review, testing and/or approval controls appropriate to the relevant change;
- CI/CD checks for build quality and selected security conditions;
- secret scanning before or during code integration;
- separation of server-only secrets from frontend build-time variables;
- deployment and rollback procedures appropriate to the production architecture; and
- environment-specific configuration intended to reduce accidental production exposure.
SmartDry may use automated coding or AI-assisted development tools, but remains responsible for the security controls and review practices applied to code deployed as part of the Services.
11. Vulnerability and Dependency Management
SmartDry will maintain processes designed to identify, assess, prioritise and remediate material vulnerabilities affecting systems under its control.
The process may include:
- monitoring relevant dependency, platform or provider security advisories;
- using supported software versions where reasonably practicable;
- risk-based patching or compensating controls;
- prioritising vulnerabilities based on exploitability, exposure, impact and affected data;
- security testing proportionate to the relevant change, component or identified risk; and
- third-party testing or specialist review where SmartDry determines it is appropriate to the risk and maturity of the Services.
Unless expressly stated in an Order Form, this Schedule does not promise a fixed penetration-testing frequency, vulnerability-remediation SLA, CVSS deadline or particular third-party certification.
12. Logging, Auditability and Security Monitoring
SmartDry will maintain logs and audit information appropriate to the relevant Services and risks. The precise events and retention periods may vary by system.
Security-relevant logging may include, where supported:
- authentication and access events;
- privileged or administrative actions;
- selected Customer or staff configuration changes;
- API and integration activity;
- application, infrastructure and database errors;
- security events and suspected abuse; and
- operational audit trails for sensitive workflow or data-management functions.
Access to security logs will be limited according to operational need. SmartDry may use managed logging, monitoring, error-tracking or alerting services to detect faults and security events.
Logging is designed to support operational investigation and security response; it is not a guarantee that every action in every SmartDry module will be permanently recorded.
13. Availability, Backup and Recovery
SmartDry will maintain availability, backup and recovery arrangements appropriate to the architecture, data stores and risks of the Services.
Measures may include:
- managed database backup or point-in-time recovery capabilities where included in the selected infrastructure service;
- replication, redundancy or managed resilience features where appropriate;
- documented deployment, rollback or restoration procedures for material components;
- backups or export mechanisms for production data stores where appropriate; and
- business-continuity and incident-response arrangements designed to restore service following material disruption.
Unless expressly stated in an SLA or Order Form, SmartDry does not commit in this Security Schedule to a specific recovery-time objective (RTO), recovery-point objective (RPO), uptime percentage or zero-data-loss guarantee.
14. Security Incident Management
SmartDry will maintain procedures for identifying, triaging, containing, investigating, remediating and recovering from material security incidents affecting systems under its control.
Where appropriate to the incident, SmartDry may:
- restrict or revoke compromised accounts, tokens or credentials;
- isolate affected services or systems;
- preserve relevant logs and evidence;
- rotate or revoke affected secrets;
- apply patches, configuration changes or other containment measures;
- assess affected data, Customers and service functions;
- coordinate with relevant infrastructure or Subprocessors; and
- conduct post-incident review and remediation.
Personal Data Breach notification and Customer assistance obligations are governed by the DPA. Nothing in this Schedule extends or shortens a notification period expressly stated in the DPA or required by applicable law.
15. Personnel Security and Confidentiality
Personnel authorised to access Customer Data will be subject to appropriate confidentiality obligations and will receive access according to their responsibilities and legitimate business need.
SmartDry will maintain proportionate joiner, mover and leaver controls designed to grant, change and remove access as responsibilities change.
Security and privacy awareness will be provided as appropriate to the responsibilities of personnel who develop, administer, support or otherwise handle systems containing Customer Data.
16. Supplier and Subprocessor Security
SmartDry may rely on cloud, database, communications, monitoring, support, AI and other technology providers. SmartDry will apply supplier security and privacy diligence proportionate to the nature of the service and the data or systems to which the supplier has access.
Where a supplier is a Subprocessor of Customer Personal Data, the DPA governs authorisation, contractual protections, transfer safeguards and SmartDry's responsibility for that Subprocessor.
The current Subprocessor Register should be used to identify material Subprocessors and processing locations. The Register may change in accordance with the DPA without requiring amendment of this Security Schedule.
17. Data Handling, Minimisation and Retention
SmartDry will design and operate the Services to avoid unnecessary privileged access to Customer Data and will maintain retention and deletion practices consistent with the Agreement, DPA and applicable law.
Customer Data will not be intentionally copied into development, testing or support environments merely for convenience where a less intrusive alternative is reasonably available. Where production-derived information is required for legitimate troubleshooting or testing, SmartDry will apply access, minimisation or masking controls appropriate to the purpose and risk.
Customer-Specific AI Resources that contain or encode Customer Data remain subject to the confidentiality, data-protection, deletion and non-reuse restrictions in the Master Terms and DPA.
18. AI and Automation Security
Where SmartDry uses AI-enabled functionality, SmartDry will apply the security and access-control principles in this Schedule to Customer Data processed through that functionality.
SmartDry will not intentionally use identifiable Customer Data to train or improve a Shared AI Model except where the Customer has provided the express opt-in authorisation required by the Master Terms. Third-party AI providers processing Customer Personal Data on SmartDry's behalf are subject to the DPA and applicable Subprocessor controls.
SmartDry may use technical safeguards, prompt controls, output validation, access restrictions, content filters or other measures where appropriate to reduce risks such as unauthorised data disclosure, malicious input or misuse of AI-enabled functionality. Such measures do not guarantee that AI outputs are error-free or immune from manipulation.
19. Payment and Financial Data Security
Unless applicable Payment Services Terms expressly state otherwise, SmartDry is not intended to store raw card security codes, magnetic-stripe/card-track data or other authentication data that should be handled only by an authorised payment provider.
Where SmartDry integrates with a payment processor, bank, acquirer or payment-service provider, payment credentials and sensitive payment processing should be handled through the relevant provider's approved interfaces to the extent supported by the integration.
Nothing in this Schedule represents that SmartDry itself is PCI DSS certified unless SmartDry expressly confirms such certification in writing.
20. Customer Security Responsibilities
Security of the Services is shared with the Customer. The Customer must comply with the Master Terms and Acceptable Use Policy and is responsible for security controls within its own environment.
The Customer should, as appropriate to its business:
- maintain secure Customer-controlled devices, networks and internet access;
- protect credentials, administrator accounts, API keys and integration tokens;
- use multi-factor authentication where made available for relevant privileged accounts;
- promptly remove access for staff or contractors who no longer require it;
- configure roles and permissions consistently with least privilege;
- maintain lawful and appropriate security controls for third-party integrations selected by the Customer;
- avoid placing passwords, private keys, raw payment-card credentials or unnecessary sensitive data in free-text fields; and
- promptly notify SmartDry of suspected account compromise, unauthorised access or other security issues affecting the Customer's use of the Services.
SmartDry is not responsible for a security incident caused solely by Customer systems, credentials, integrations or conduct outside SmartDry's reasonable control, subject to the Agreement and applicable law.
21. Security Assurance and Customer Information Requests
Subject to the DPA and the Agreement, SmartDry will make available information reasonably necessary for an eligible Customer to understand the security measures applicable to the Services.
SmartDry may satisfy routine security-diligence requests through this Security Schedule, the DPA, the Subprocessor Register, written security documentation, standard questionnaires, third-party reports or other reasonable evidence.
SmartDry is not required to disclose information where disclosure would materially increase security risk, expose another customer's data, reveal privileged or confidential security information beyond what is reasonably necessary, violate law or supplier obligations, or provide source code, passwords, secret keys, exploit details or unrestricted production-system access.
Formal audit and inspection rights relating to Customer Personal Data are governed by the DPA.
22. Changes to Security Measures
Security technologies and threats change over time. SmartDry may modify, replace or improve individual controls, providers, tools and implementation details without amending this Schedule, provided SmartDry does not materially reduce the overall level of protection for Customer Personal Data contrary to the DPA or materially reduce an expressly agreed security commitment during the applicable Subscription Term without lawful justification.
SmartDry may make immediate changes where reasonably necessary to address a security vulnerability, active threat, legal requirement, supplier change or service-integrity issue.
23. Security Vulnerability and Incident Reporting
A Customer that believes it has identified a vulnerability, compromise or material security issue affecting SmartDry should notify SmartDry promptly through the designated support channel or by email to legal@smartdry.ai, with sufficient information to allow SmartDry to assess the issue.
The Customer must not conduct penetration testing, vulnerability scanning, exploit testing, destructive testing or attempts to access another Customer's data without SmartDry's prior written authorisation, except to the extent a published SmartDry vulnerability-disclosure programme expressly permits the relevant activity.
SmartDry may provide a dedicated security-reporting address or vulnerability-disclosure process in the future without requiring amendment of this Schedule.
24. No Certification or Absolute-Security Representation
This Security Schedule describes contractual security measures and control objectives. It is not a certification report, penetration-test report, audit opinion or representation that every stated control is implemented in an identical technical manner across every SmartDry component.
Unless expressly stated in an Order Form or written certification statement issued by SmartDry, the Agreement does not represent that SmartDry is certified under ISO 27001, SOC 2, Cyber Essentials, PCI DSS or another assurance framework.
Any certification, external assessment or security report later obtained by SmartDry is governed by its own scope, period and limitations and does not automatically amend this Schedule.
25. Term, Survival and Order of Precedence
This Security Schedule applies for the period in which the relevant Services are provided and for so long thereafter as SmartDry retains Customer Data subject to continuing security obligations under the Agreement or DPA.
The Agreement's liability, confidentiality, audit, termination, data-return/deletion and dispute provisions apply to this Schedule.
For Customer Personal Data processed by SmartDry as Processor, the DPA prevails over this Schedule to the extent of a direct conflict. Otherwise, the order of precedence in the Master Terms applies.
Appendix A - Baseline Technical and Organisational Measures
The table below summarises the baseline control domains described in this Schedule. It is intended as a concise due-diligence reference and does not replace the operative provisions above.
| Control domain | Baseline SmartDry measure |
|---|
| Governance & risk | Risk-based security programme; ownership of security activities; documentation and remediation tracking proportionate to service maturity and risk. |
|---|
| Identity & access | Authenticated access; role/function-based permissions where supported; least privilege; controlled privileged access; access removal/adjustment when no longer required. |
|---|
| Tenant isolation | Tenant/business/location scoping; database RLS or equivalent controls where appropriate; server-side checks for privileged operations; UUID/scoped-query patterns. |
|---|
| Secrets & credentials | Server-side privileged secrets; restricted secrets configuration; client-key guards; repository/CI secret scanning; rotation/revocation following suspected compromise. |
|---|
| Encryption & network | Encrypted transport over public networks; provider-native encryption at rest or equivalent where applicable; edge/reverse-proxy/network controls appropriate to internet-facing services. |
|---|
| Application & API | Authentication/authorisation at trust boundaries; tenant-aware access; validation; privileged-function segregation; idempotency/abuse controls where relevant. |
|---|
| Secure development | Controlled repositories; review/testing/CI appropriate to change; secret scanning; environment configuration and rollback practices. |
|---|
| Vulnerability management | Security-advisory awareness; supported software where practicable; risk-based patching and mitigation; proportionate testing. |
|---|
| Logging & monitoring | Authentication, administrative, fault and security logging where supported; restricted log access; monitoring and alerting appropriate to risk. |
|---|
| Availability & recovery | Managed backup/recovery capabilities; resilience features where appropriate; deployment/rollback/restoration and continuity processes; no fixed RTO/RPO unless separately agreed. |
|---|
| Incident response | Triage, containment, investigation, remediation, recovery, evidence preservation, credential rotation and post-incident improvement as appropriate. |
|---|
| Personnel | Confidentiality; access according to role; joiner/mover/leaver processes; security and privacy awareness appropriate to responsibilities. |
|---|
| Suppliers | Risk-based supplier diligence; DPA Subprocessor requirements; contractual and transfer safeguards for Customer Personal Data. |
|---|
| Data lifecycle | Minimisation; controlled production-data use; retention/deletion under Agreement/DPA; Customer-Specific AI Resources remain protected. |
|---|
| AI security | Customer Data protected under same control framework; Shared AI Model training subject to opt-in architecture; Subprocessor controls for third-party AI providers. |
|---|
Appendix B - Current Implementation Notes
This Appendix records selected implementation characteristics of SmartDry as at the Effective Date. It is informational evidence of how certain control objectives are currently implemented and does not prevent SmartDry from replacing a mechanism with an equivalent or stronger control under Section 22.
Tenant-scoped database controls: SmartDry uses Supabase/Postgres in parts of the platform and has database migrations that enable and, in selected internal tables, force Row Level Security. Other tables use business/location identifiers and application/server enforcement according to function.
Privileged database credential separation: The Supabase service-role credential is treated as a server-only secret. SmartDry maintains an automated repository check designed to fail if service-role patterns are found in client-facing application source.
Secret scanning: SmartDry maintains layered secret-scanning practices in the repository, including staged/pre-commit scanning and CI scanning. GitHub push-protection controls may also be used where enabled for the repository/account.
Production topology: SmartDry production architecture is designed around hosted frontend applications, a server-side Node/Express API and managed database/infrastructure services, with reverse-proxy/edge routing. Exact deployment topology may evolve.
Audit-oriented data design: Selected operational modules use append-oriented or immutable audit patterns, idempotency keys and tenant/location identifiers to support traceability and reduce duplicate or unauthorised transaction effects.
Implementation note: Appendix B is not a promise that every listed mechanism is used identically in every module. The binding requirement is the relevant control objective and overall protection described in the operative sections of this Schedule.
SmartDry Technologies Limited
Company Number: 17302780
© 2026 SmartDry Technologies Limited. All rights reserved.
