We handle financial data. Here is how we protect it.
Snapcite is Pre-Seed and honest about that. This page describes our current security posture: what we do, what we use, and how to reach us if you find a problem.
Our current posture: Snapcite is aligned with common information security practices for a company at our stage. We are not SOC 2 certified today, and we will not claim otherwise. We are working toward a formal audit as we grow, and we will update this page as that progresses.
What we have in place.
Encryption in transit
All data sent between your browser and Snapcite travels over TLS 1.2 or higher. Receipt uploads, API calls, and session traffic are encrypted end to end.
Encryption at rest
Receipt images and extracted expense data are stored encrypted on our database and object storage provider. Encryption keys are managed separately from the data they protect.
Least-privilege access
Internal access to production data is limited by role. Engineers do not have standing access to customer financial records; access is requested, logged, and time-limited.
Authentication and session controls
Accounts are protected by email-based authentication with secure session tokens. Sessions expire on inactivity and can be revoked from your account settings.
Data deletion
When you delete receipts or close your account, your financial documents are permanently removed from our systems. We do not retain them for analytics or model training after deletion.
Data ownership
Your receipts and expense data belong to you. You can export everything as CSV or delete it permanently from your settings at any time, without contacting support.
Who else handles your data.
Snapcite routes receipt processing and hosting through a small number of trusted third-party providers. Each one is listed here with the role they play.
Receipt images are sent to OpenAI's API for extraction. OpenAI's data processing agreement applies. See openai.com/policies.
Snapcite's web application and API run on Vercel's infrastructure in the United States.
Snapcite's primary database runs on Neon. Data is stored in US-based regions.
Found a vulnerability? Tell us.
If you believe you have found a security issue in Snapcite, please report it directly to our security team. We will acknowledge your message within two business days, investigate promptly, and keep you informed as we address it.
We ask that you give us reasonable time to fix a confirmed issue before public disclosure. We do not operate a paid bug bounty program today, but we take every responsible report seriously and will thank you by name if you choose.
Please include a description of the issue, the steps to reproduce it, and any relevant screenshots or logs. Encrypted email is welcome; ask and we will share our public key.