Security

Email [email protected] with a clear description, affected URL or workspace, reproduction steps, and the impact you observed. Please do not include customer data you do not need to share.

Snoot will acknowledge a good-faith report, investigate it, and keep the reporter updated when practical. Do not exploit a vulnerability beyond what is needed to confirm it, access another person's data, disrupt the service, or publicly disclose an unresolved issue.

• Encrypted HTTPS and WebSocket connections protect data in transit.
• Workspace data is scoped by organization and backed by database constraints at critical boundaries.
• Authentication, widget identity, attachment, and continuation links use signed or verified tokens.
• Stripe handles payment-card collection; Snoot stores subscription references, not complete card numbers.
• Account export, self-deletion, session invalidation, and admin controls are built into the product.
• Automated tests cover tenant isolation, authorization, browser workflows, billing reconciliation, and recovery-sensitive jobs.

Workspace admins should keep membership current, protect email accounts used for magic links, keep server-side identity secrets out of browser code, and collect only the customer information they need. If you believe an account is compromised, contact Snoot immediately.

Snoot does not currently claim a formal security certification or a standard uptime SLA. For vendor reviews, privacy questions, or a responsible-disclosure follow-up, email [email protected].