Security

You keep client names, rates and the value of your contracts in WorkSnap. What we do with that data is on Your data. This page answers the other question — what stops someone else from getting to it — including what isn’t in place.

Signing in

• Two-factor authentication. Turn it on in your profile and every password login also asks for a code from an authenticator app. You get recovery codes for the day you lose your phone. It’s optional, not enforced.
• Sign in with Google. If you log in with your Google account, Google’s own protection — including its 2-Step Verification — guards the login instead.
• Passwords are never stored. Only a one-way bcrypt hash is kept. Login attempts and password-reset requests are rate-limited.
• Your email address can’t be switched silently. It’s how you recover your account, so a new address only takes effect after you confirm it from that inbox.

Your data, walled off

• One account, one set of data. Every client, project and time entry belongs to exactly one account. That’s enforced where the data is read, on every query — not just hidden in the interface — and every action on a record checks that it’s yours. With no shared workspaces, there’s no permission model to get wrong.
• Encrypted in transit and at rest. WorkSnap is served over HTTPS only; session cookies are HttpOnly and sent over secure connections only. The database is encrypted at rest by Google Cloud.
• Backed up. The database has automated backups with point-in-time recovery, stored in the EU.
• Deleted means deleted. A closed account is kept for 30 days so you can restore it, then permanently erased. Copies inside backups disappear as those backups expire on their normal rotation.

How changes are checked

• Automated checks on every change. Static analysis of the code, a scan of every dependency against known vulnerabilities, and a scan for secrets committed by mistake.
• A security review of every change. It’s AI-assisted: an AI model reviews the change for vulnerabilities, and I check its findings and decide on the fixes myself. Findings are recorded, so the same mistake is easier to spot next time.

What WorkSnap doesn’t have

• No SOC 2, no ISO 27001 — and there won’t be. For a one-person project, certification costs far more than it’s worth to the freelancers who use it, and that cost would have to come from a paid plan that doesn’t exist.
• No independent audit or penetration test. The reviews above are my own process. Everything on this page is specific enough to hold me to, but no third party has verified it.
• No passkeys or hardware security keys. Two-factor authentication means an authenticator app.

Found a vulnerability?

Write to info [at] worksnap [dot] eu . I’ll confirm I’ve received it and keep you posted until it’s fixed. There’s no bug bounty. Please test only against your own account and never touch anyone else’s data.

A machine-readable version of this contact is at /.well-known/security.txt.