In development. The controls below are under internal security review.
How Snapeted protects customer data.
Snapeted holds no security certification today, such as SOC 2 or ISO 27001. This page lists only controls that exist in the product, and it changes when they do.
Controls in the product.
- Organization data is separated in the database
- Tables the app reads directly use PostgreSQL row-level security; the rest is reachable only through database functions that check your session and membership. The app's database login cannot bypass these rules, and an organization ID sent by the browser never grants access on its own.
- Sessions use secure cookies
- Session cookies are HttpOnly, Secure and host-only (the __Host- prefix), so page scripts cannot read them and other subdomains cannot set them.
- Traffic is encrypted
- Pages and APIs are served over HTTPS, and browsers are told to keep using HTTPS for this site (HSTS). Pages cannot be framed by other sites.
- AI stays inside your permissions
- Mark and Flow agents can only use the tools allowed for the role in question, checked on the server at every call. Text from customers, files and web pages is labeled as untrusted data for the model, and it can never widen what Mark or an agent is allowed to do.
- This site does not track you
- The public site sets no cookies of its own, loads no third-party scripts and runs no analytics.
Privacy documents.
The current versions of the documents that govern personal and customer data in Snapeted.
Start with your team today.
Create your organization now and invite your team. Each service opens as it launches.