Smartsheet Subprocessors

Smartsheet engages third party service providers to help us run and scale our business and Online Services. Where these service providers process the content customers choose to upload or submit to our online subscription services, they are classified as "Subprocessors,'' and must meet related Smartsheet due diligence requirements.

Included on this page are the Subprocessors that Smartsheet engages today; this list is subject to change at Smartsheet's discretion. This webpage is provided as a high-level overview; additional details, including Data Transfer Impact Assessments, are available, which can be obtained by contacting your sales representative or by submitting this form.

Table of Contents

Subprocessors:

• Customer Support Subprocessors
• Smartsheet Corporate Entities
• Infrastructure Subprocessors:

  • Smartsheet

  • Brandfolder

  • Content Automation

  • Resource Management

  • Resource Management European Union

  • Smartsheet Gov

  • Smartsheet Regions Australia

  • Smartsheet Regions European Union

• Smartsheet Private Beta Program Subprocessors
• Professional Services

Additional Information:

• Frequently Asked Questions (FAQs)
• Revision History

Customer Support Subprocessors

Subprocessors included in this section apply when you engage with Smartsheet as an organization and purchase or use any of our Online Services or engage Smartsheet for professional services. Customer Content may be processed by the Subprocessors in this section but only if Customer chooses to provide Customer Content in interactions with Smartsheet personnel. These Subprocessors do not have automated, continuous data transfers from any of our Online Services unless otherwise noted in the related Infrastructure Subprocessor section. 

For more information on security features that allow customers to control access to data, please refer to the Smartsheet Security Whitepaper.

Smartsheet Corporate Entities

Smartsheet may engage one or more of the following corporate entities, each (with the exception of Smartsheet Inc.) a wholly-owned subsidiary of Smartsheet Inc., as Subprocessors to deliver some or all of the Services provided to customers.

Smartsheet - Infrastructure Subprocessors

Subprocessors included in this section apply to the use of the Smartsheet application and premium apps offered by Smartsheet (e.g., Bridge, Calendar, Control Center, Pivot).

Subprocessor Frequently Asked Questions

Does Smartsheet have written agreements with its Subprocessors?

Yes; our selection and engagement of each Subprocessor is subject to written agreements containing data protection terms required by applicable laws and our contractual commitments with our customers.

What are the integrations and connectors to the applications offered by Smartsheet?

Our Online Services may provide access via connectors and integrations (collectively, “Integrations”) to third party accounts such as Microsoft, Tableau, Slack, or Facebook. Integrations can be used to pull and/or push information from or to Smartsheet , and to enable the applicable third party to receive notifications, such as sheet updates. Any information users authorize to be transferred from Smartsheet Online Services to an Integration is governed by the third party’s privacy and security obligations, including the Subprocessors that they may engage. We encourage you to carefully read the privacy statement of any third party you authorize to receive information from Smartsheet Online Services. Additional information on available Integrations is available at www.smartsheet.com/integrations.

Does Smartsheet have a process for vetting or selecting Subprocessors to engage?

Yes; Smartsheet Subprocessors are reviewed during the initial engagement and they go through periodic security review to ensure security controls are in place for protecting customer data. Where applicable, Smartsheet will review security attestations for Subprocessors including, but not limited to, reviewing SOC I and/or SOC II reports, vulnerability and penetration tests, PCI-DSS audits, and external security risk assessments.

How does Smartsheet evaluate AI Subprocessors?

In addition to the standard Subprocessor vetting process described above, Smartsheet conducts additional due diligence when evaluating AI Subprocessors. This includes reviewing the AI provider’s data handling and retention practices, confirming contractual restrictions on the use of Customer Content, assessing the provider’s approach to data isolation and access controls, and evaluating the availability of regional processing options where applicable.

Is Customer Content used to train or improve Subprocessors’ AI models?

No; Smartsheet’s agreements with its Subprocessors prohibit the use of Customer Content to develop, improve, or train third party foundational models. For additional details, please refer to the Smartsheet AI Security Whitepaper.

Where is Customer Content processed when using AI-powered features?

The processing location for AI-powered features depends on the Smartsheet application being used. For the Smartsheet application, AI features are provided by a generative AI services provider located in the United States. Customer Content submitted to AI features within Smartsheet Regions is processed within the applicable region (e.g., for Smartsheet Regions Australia, AI processing occurs within Australia). Please refer to the Infrastructure Subprocessor sections above for the specific processing locations applicable to each Smartsheet Online Service.

Will my organization receive notice of additions to this Subprocessor page?

Yes; customer SysAdmins are notified of additions to the Subprocessor list. Smartsheet will provide advance notice of new Subprocessors in accordance with the notification period set forth in the Data Processing Addendum (DPA) incorporated into the terms governing your use of the Online Services.  

Who can I contact if I have questions or concerns about the Smartsheet Subprocessor page?

Additional information regarding our use of Subprocessors is available in the Smartsheet Security Packet. Please contact your sales representative or submit this form to obtain a copy.

Revision History

The revision history for this page is available for review here.