Security at Snipfruit

Sign-in is handled by a managed authentication service. We never build custom password handling and we never store your password ourselves. Email verification is required before your account becomes active, and sessions are handled with secure, refreshable tokens.

• Row level security is enabled on every table that holds personal data.
• Policies bind every record to the signed-in account, for reading and writing.
• Records cannot be assigned to another person's account.
• Privileged keys exist only on the server and are never exposed to the browser.

Administrative access is decided by a role stored server side and checked on every privileged request. Hiding a button is never treated as a security control.

Multi factor authentication on your Snipfruit account, breach monitoring and external account connections are in development. Anywhere they appear in the product, they are clearly marked as coming soon until they are live.

If you believe you have found a security issue, please contact us through the Support page inside your account. We will acknowledge responsible reports and keep you updated.