Security at Snagfly
How we protect your account, your data, and your payments. Snagfly is built on security-first infrastructure and a documented set of internal security policies, reviewed at least annually.
Encryption
All traffic to snagfly.com and app.snagfly.com is encrypted in transit with TLS 1.3. Personal data is encrypted at rest with AES-256 in our managed Postgres database.
Payments & card data
Payments are processed by Paddle as our Merchant of Record. Paddle is certified PCI-DSS Level 1 — the highest level. Snagfly never sees, stores, or processes your card details.
Infrastructure & network
Snagfly runs on Vercel (global edge hosting) and Supabase (managed database & authentication), both SOC 2 compliant. Cloudflare provides a web application firewall, DDoS protection, and bot mitigation (Turnstile) in front of the app.
Access & authentication
Accounts use securely hashed credentials. Database access is restricted with row-level security, administrative access follows least-privilege, and multi-factor authentication is enforced on our critical provider accounts.
Your data & privacy
We collect only what we need to run the service and never sell your data. You can access, export, or delete your data on request. EU/UK visitors are given a cookie-consent choice. Full detail is in our Privacy Policy.
Availability & backups
The service runs across a global edge network with a highly available database and automated backups. Disaster recovery is tested at least annually.
Policies & governance
We maintain a documented security policy set — access control, data protection, incident response, secure development, vendor management, business continuity, logging, and change & vulnerability management — approved by our security lead and reviewed at least annually. We assess our controls against the CSA Cloud Controls Matrix (CAIQ v4).
Responsible disclosure
Found a security issue? Please report it through our contact page and mark it “Security”. We’ll respond promptly — please give us reasonable time to remediate before any public disclosure.