Security

snoozestack runs on infrastructure operated by a major cloud provider, and your project data is hosted in the United States. We do not replicate it to other geographies, and we do not send it to third parties beyond the small set of providers needed to run the Service, which are listed in our Privacy Policy.

If your organization has a data-residency requirement that this does not meet, talk to us before you build on it rather than after.

In transit. Traffic between you, your end users, and the Service — the console, the CLI, project APIs, and custom domains — is encrypted with TLS over public networks.

At rest. Databases, uploaded files, and backups are encrypted at rest using our cloud provider's managed encryption, with key management handled by that provider.

Separation between customers is enforced by giving each project its own resources — its own database, its own file storage, its own runtime, and its own credentials — rather than by putting every customer in one store and filtering.

Project runtimes are not directly reachable from the public internet. Requests arrive through the platform, which is responsible for routing each one to the right project.

Project API keys. Each project has a public key, safe to ship in client applications, and a secret key that is privileged and must stay on your server. Owners can view and rotate their project's keys in the console.

End-user sessions. Sessions issued to your application's end users are short-lived and can be revoked.

Project secrets. Secrets you set for a project — third-party credentials, signing keys, provider client secrets — are stored encrypted and made available only to your project's own runtime. Our APIs report whether a secret is set, never its value.

Internal access. Access to production systems is limited to the people who operate the Service, and our internal permissions are scoped to what each part of the platform needs. As our Terms state, we access customer data only to operate, secure, and support the Service, or where the law requires it.

Public endpoints sit behind a managed web application firewall covering common attack categories, and we apply provider security updates as part of routine operations. Our internal components — databases included — are not reachable from the public internet: they accept connections only from our own systems, and those connections are themselves encrypted and credential-gated.

Project databases are backed up automatically on a rolling window, and project data is replicated to durable storage so a project can be restored if a machine is lost.

To be straightforward with you: backups are a recovery mechanism, not a guarantee. We do not publish a recovery-time objective or a disaster-recovery attestation, and the Service is provided as described in our Terms. If your data is critical, keep your own exports — you have direct programmatic access to your project's database, files, and configuration through the CLI, the SDKs, and the management API at any time.

We collect operational logs and metrics so we can run, secure, and debug the Service. Operational status is published at status.snoozestack.com, which runs independently of the rest of the platform so it can report an outage that affects it. If a security incident or material privacy event affects your data, we notify the account contact by email and, where appropriate, through the status page.

What we collect and how long we keep it are set out in the Privacy Policy. In summary: account and project data persists while your account is active, and operational logs, activity history, and backups are kept for limited periods and then age out.

Deletion. Deleting a project removes its database, its stored files, its queues, and its running services. An end user of your application can delete their own account and identity data through the identity SDK. When you close your account, we remove your account and project data; copies that remain inside a short-lived backup age out with that backup rather than being erased individually.

Data your own project stores about your own end users is yours — you are its controller, and your own privacy policy governs it.

snoozestack secures the platform: the infrastructure, the network, encryption, and the isolation between projects. You secure what you build on it: your application code and dependencies, how you store and protect your project's API keys and secrets, the access control and authorization rules inside your own functions, and the data you and your end users choose to store. Keeping your secret key server-side, and reviewing your own function authorization, are yours to own.

We would rather tell you what we do not have than imply we do. We do not hold, and do not claim, SOC 2, ISO 27001, HIPAA, or PCI certification, and we do not currently run a formal third-party penetration test or a paid bug-bounty program. When any of that changes, it will appear here with its scope and date — not before.

No method of transmission or storage is completely secure, so no provider — including us — can guarantee absolute security.

If you believe you have found a security issue, email support@snoozestack.com with the details and steps to reproduce. Please test only against your own account and projects, avoid accessing or modifying other customers' data, and give us a reasonable chance to respond before disclosing publicly. We investigate reports made in good faith and will not pursue action against researchers who follow this guidance.

Security or privacy questions? Contact support@snoozestack.com.