Security
Snaglist finds the loose ends on your site. Here you can see how we handle our own site: where your data is stored, who can access it, and the scores that everyone can check.
Where your data is stored
The app and the database. Your sites, crawls, reports and account.
The crawls themselves, the PDF reports and our code.
Payment is handled via Mollie, invoices via WeFact, and email via Brevo. All European companies. What is still American, and why
Who can join
You log in with a code by email or with an access key. We don’t store passwords, so none can leak.
Built and managed by us, on our own server. No external login service in between.
Every page and every action checks who you are and which team you belong to. A different number in a link won’t open another user’s site, report or invoice.
Connection and servers
Your browser is told by us that it must never use an unencrypted connection for two years.
On our servers, you only log in with a key. Thousands of hacking attempts per week are blocked by it.
Only web traffic is coming in. The database only responds with a short list of known addresses.
Security updates install themselves, every day.
Left to check
Not quite A+ everywhere yet. We’re missing a Content-Security-Policy, the very rule we recommend to our own clients. That’s next on our list. After that we’ll measure again and the new score will appear here, with the date.
What we never do
We never run a full security scan on a site unless you can prove it is yours. First, you show you control it via Google Search Console or a small file on the site. This rule applies to everyone, including us.
Otherwise, Snaglist becomes a scanner for intruders. A stolen account is not a key to someone else’s site.
Leak found?
Found a weak spot in Snaglist? We’d love to hear about it, and we’ll fix it quickly.