What Smoothx Does
Smoothx is a multi-product ecosystem that integrates Procore and other construction platforms with industry-leading accounting systems. Whether it’s synchronising financial data between Procore and your accounting system, managing Cost+ contracts, replacing manual uploads and siloed email inboxes with our OCR invoice scanner, or bulk-extracting critical Procore data for close-out and handover, Smoothx is purpose-built to maximise your investment in the platforms you already use.
Smoothx is offered as a multi-tenant, cloud-based Software as a Service (SaaS) solution, accessed over a securely encrypted connection via your web browser. Native iOS and Android mobile apps are available for ProScan+. Because Smoothx is cloud-based, software updates, security patching, and infrastructure management are handled by our team — freeing your team to focus on building.
Where Your Data Lives
Smoothx is hosted on DigitalOcean and Amazon Web Services infrastructure in the United States, behind Cloudflare’s global network. Our infrastructure providers supply enterprise-grade physical security, and we run a multi-server architecture with database replication and regular backups to protect against hardware failure and support fast recovery. For a full list of the third-party providers that process or store customer data — including their purpose and location — see our Data Subprocessors page.
Encryption
In transit: all connections to Smoothx are secured with HTTPS using Transport Layer Security (TLS 1.2 or higher), with AES-256 encryption and modern key-exchange and message-authentication algorithms.
At rest: all customer data stored on the Smoothx platform is encrypted at rest using AES-256, with keys managed through our infrastructure providers’ managed encryption services.
Network Security
Only the traffic needed to operate the service reaches our systems. Smoothx uses Cloudflare’s web application firewall (WAF) with continuously updated managed rules, DDoS mitigation operating around the clock, network segmentation, and hardened server configurations. Firewall and infrastructure changes are managed through configuration tooling and reviewed before deployment.
Secure Development
Code changes are peer-reviewed through pull requests and pass an automated test pipeline before release, with dedicated test and staging environments used to validate updates prior to production. Our continuous integration pipeline automatically audits application dependencies against known-vulnerability databases on every change, and automated dependency update tooling raises security patches as they become available.
Vulnerability Management and Security Testing
Smoothx maintains a layered approach to finding and fixing weaknesses before they can be exploited:
- Independent penetration testing — carried out annually by an external party, with findings remediated and reports available to customers and partners under NDA.
- Automated security scanning — application and cloud security scanning via dedicated tooling, plus dependency vulnerability audits in our CI pipeline.
- Endpoint protection — endpoint detection and response tooling deployed on production infrastructure.
- Managed patching — operating system security updates are applied automatically through our managed hosting platform, and application dependencies are updated routinely.
Monitoring, Availability and Backups
All production systems run continuous automated error and performance monitoring, with alerts delivered to our engineering team at any hour. Customer data is protected by database replication across multiple servers and regular backups, supporting fast recovery from hardware failure, data corruption or accidental deletion. Updates are deployed without scheduled downtime windows; in the rare case that planned maintenance would affect access, we communicate it to customers ahead of time.
Access Control
Inside Smoothx: access to customer data by Smoothx personnel follows the principle of least privilege — limited to legitimate business needs such as supporting your use of the platform — and is protected by multi-factor authentication. Access rights are reviewed periodically.
In your account: Smoothx provides two-factor authentication, automatic lockout after repeated failed sign-in attempts, idle session timeouts, and admin-controlled user permissions, so you control who on your team can see and do what.
Incident Response and Breach Notification
Smoothx maintains a documented Incident Response Plan, based on industry best practice and reviewed regularly, covering both application and security incidents. In the event of a security breach or data loss affecting customer data, we notify affected customers and relevant authorities without undue delay, in accordance with applicable law.
Privacy and Compliance
Smoothx handles personal information in accordance with the Australian Privacy Act 1988 (Cth) and, where applicable, the GDPR. For customers, your data remains yours: we process it solely to provide the service, and we never sell it or use it to train AI models without your consent. Read more in our Privacy Policy and on our Data Subprocessors page.
Onboarding, Support and Product Feedback
Our Customer Success team is dedicated to a successful rollout of Smoothx products across your company. A dedicated Smoothx Implementation Manager will walk you through each phase of the implementation roadmap, and every client is supported by an Account Executive and a Customer Success Manager, backed by documentation, training materials, videos, FAQs and guides in our online support portal. Support requests can be submitted at any time, and our team responds across time zones.
Product development is driven by our customers: ideas and feedback submitted through our User Voice Feedback Forum inform our product priorities, and we run beta programs that customers can join for early access to new features.
Reporting a Security Concern
If you believe you have found a security vulnerability in a Smoothx product, or have any security question, contact us at [email protected]. We investigate all reports and appreciate responsible disclosure.