What SmishAlert sees in each deployment mode
A procurement-grade summary of what SmishAlert captures—and never touches—in Personal and Workforce modes.
What SmishAlert sees is determined by the deployment mode your organization selects—surfaced in the admin console and reviewable in procurement. See Deployment modes for the full descriptions; this is the data-flow summary.
Personal mode
- Sees: only the messages and screenshots a user explicitly reports (body, sender, timestamp, classification).
- Never sees: unknown-sender messages the user didn't report, anything from contacts/known senders, photos, location, address book, or other phone data.
Workforce mode (organization default)
- Sees: every unknown-sender SMS/iMessage body and sender on iOS (via the Message Filter extension); on Android, every message the employee reports; device metadata (carrier, OS, app version—no advertising IDs); classification verdicts and campaign clusters.
- Never sees: messages from contacts or known senders, photos, location, address book, browsing, third-party apps unless an employee screenshots and submits, or employees who aren't enrolled.
Architecture, retention, and subprocessors
On-device classification is the first verdict in every mode; in Workforce mode the iOS Message Filter sends unknown-sender content for second-pass classification. Default retention for reported content is 90 days (custom retention and EU residency available on Enterprise). Subprocessors include Neon, Stripe, Google Firebase, PostHog, and Intercom. Detailed data-flow documentation and the DPA are available for procurement—email support@smishalert.ai, and see the Trust page on smishalert.ai.