Smartsheet procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “Smartsheet and its U.S. affiliates participate in the EU-U.S. Data Privacy Framework (" EU-U.S. DPF "), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (" Swiss-U.S. DPF ") as set forth by the U.S. Department of Commerce (collectively, "the Data Privacy Framework "). We are committed to complying with the Data Privacy Framework Principles (" Principles ") with respect to personal data transferred to the United States from the European Economic Area (EEA), the United Kingdom (UK), and Switzerland. To learn more about the Data Privacy Framework, and to view our certification, please visit https://www.dataprivacyframework.gov . Smartsheet’s commitments under the Data Privacy Framework Principles are subject to the investigatory and enforcement powers of the United States Federal Trade Commission. In certain situations, we may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements (please see our Trust Center for additional information). Smartsheet is and will remain liable for the processing of personal data it receives under the Data Privacy Framework and subsequently transfers to a third party acting as an agent on its behalf (see "How We Share Personal Data" in the applicable notice). We comply with the Data Privacy Framework Principles for all onward transfers of personal data from the EEA, UK, and Switzerland, including the onward transfer liability provisions. If there is a conflict between the terms of this Privacy Notice and the Data Privacy Framework Principles, the Principles will govern.” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “In addition, Smartsheet has implemented intercompany agreements for transfers of personal data between our affiliated companies, which require all of our affiliates to protect personal data they process in accordance with applicable data protection law. We have implemented similar appropriate safeguards where legally required with our third party service providers and partners; please see our Subprocessors page for additional details. ” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Complaints or Questions About Smartsheet’s Data Privacy Framework Certifications. If you have any questions or complaints regarding our Data Privacy Framework Certification, please complete this form or email privacy@smartsheet.com. We will respond within 45 days of receiving your complaint and will promptly investigate and attempt to resolve it. If you reside in the EEA, UK, or Switzerland, and your complaint cannot be resolved through this process, you may contact JAMS, our U.S.-based third party dispute resolution provider (free of charge). For information about how to initiate a Data Privacy Framework claim with JAMS, please contact JAMS directly at https://www.jamsadr.com/DPF-Dispute-Resolution . Under certain conditions, you may pursue binding arbitration through the Data Privacy Framework Panel. To learn more about the Data Privacy Framework Panel, please visit https://www.dataprivacyframework.gov/ .” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Smartsheet’s primary processing activities are in the United States, as detailed on the Data Residency page of our Trust Center . Personal data we collect will be transferred to, used, and stored in the United States or other jurisdictions in which Smartsheet, our affiliates, or service providers are located; these locations (including the United States) may not guarantee the same level of protection of personal data as the one in which you live. By providing us with your personal data, you agree to such transfer and/or processing. Smartsheet assesses the circumstances involving all cross-border data transfers and has suitable safeguards in place to require that your personal data will remain protected in accordance with this notice. In the event of such a transfer, we ensure that: (i) the personal data is transferred to countries recognized as offering an equivalent level of protection; or (ii) the transfer is made pursuant to appropriate safeguards, such as the applicable standard contractual clauses.” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Smartsheet relies on the EU Standard Contractual Clauses alongside the United Kingdom International Data Transfer Addendum (collectively, the “ SCCs ”) as its appropriate data transfer mechanism for EU and UK personal data. Where applicable, the SCCs are incorporated as part of Smartsheet’s standard DPA as detailed below.” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ We keep your personal data for as long as reasonably necessary for the purposes set out in our notices (see "How We Use Personal Data" in the applicable notice) or, if applicable, in accordance with the relevant terms in an agreement between you and Smartsheet. We will keep your personal data longer if required for tax or accounting purposes, to ensure we would be able to defend or raise a claim, to resolve disputes, to enforce our contractual rights, or where we have a legitimate need - though we will generally not keep personal data for longer than seven years following the last date of communication with you. Where personal data is no longer required, we anonymize or dispose of it in a secure manner. ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “Smartsheet Inc. shares personal data with our affiliated companies, including, but not limited to, Smartsheet UK Limited, Smartsheet Australia Pty Limited, and Brandfolder, Inc. (a full list of Smartsheet’s affiliates is available here ), for our or our affiliates’ internal business purposes (e.g., when you use or purchase an affiliate’s services, when you apply to one of our global offices, etc.), marketing similar products, or for other legal requirements. A reference to " Smartsheet ," " we ," or " us " is a reference to Smartsheet Inc. and the relevant affiliate involved in the processing activity. ” | Captured 2026-06-08Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.