Your data, kept apart
Q Snag is not one big shared system. Each customer gets its own copy of the app at its own web address, such as yourcompany.qsnag.com, with its own database and its own file storage. One builder's developments, snags and photos are never stored alongside another's.
Inside your copy, every request is checked on the server, so each person sees only the developments and units their role allows, photos and plans included. A snagger sees only the homes they were invited to, and only the site team for that unit can see a snagger's phone number.
Sign-in and access
- Two-step sign-in. Admins, site managers and viewers sign in with a password and a six-digit code from an authenticator app. Each browser is trusted for 30 days, then asked again. Changing your password or resetting two-step sign-in ends that trust on every device.
- Strong passwords. At least 12 characters with a number, a capital letter and a symbol. Passwords are stored only as a salted scrypt hash and cannot be read back, even by us.
- Limits on guessing. Repeated wrong passwords are blocked, and after 30 failed attempts in an hour the account is paused and its owner is emailed.
- Password reset. Reset links work once and expire after one hour. A new password signs out every other session.
- Sessions. A session lasts up to 90 days, and an admin's ends after 8 hours without use. Session tokens are stored only as hashes, so a copy of the database or of a backup cannot be used to sign in.
- Snaggers have no passwords. They join through an invite link or the QR code on the door of the home they were invited to. Invite links expire after 30 days, and a lost phone can be signed out in one tap.
- Sign in with Google is optional, and works only for accounts your site team has already set up.
Application security
- The app and this website are served over HTTPS only, with HTTP Strict Transport Security.
- Sign-in cookies can't be read by scripts, and any change that doesn't come from your own Q Snag address is refused.
- Uploaded photos and plans are checked to be the image type they claim, size-limited, given random names, and served so they can never run as code.
- Rate limits on sign-in, password reset, uploads and other sensitive actions.
- The server uses no third-party code packages, which keeps the risk from other people's software small.
- Q Snag's own hosting, code and email accounts are protected with two-step sign-in, and secrets are kept only in the hosting provider's settings.
Backups
- The database is copied every night on the server, with 14 days of copies kept.
- Every hour, the latest database copy and any new photos and plans are encrypted with AES-256 and sent off-site to Cloudflare R2 storage in the EU. Only we hold the encryption key, so the storage provider can't read them.
- Off-site database copies are kept for 30 days. A photo you delete is removed from the off-site copy 30 days later.
- If a backup fails, we are emailed straight away.
Hosting and providers
We use a small number of established providers to run Q Snag. Each processes personal data only on our instructions, under data processing terms that meet Article 28 of the GDPR.
| Provider | What it does for us | Location |
|---|---|---|
| Render | Hosts the app, its database, uploaded files and this website. | Frankfurt, Germany |
| Cloudflare | Stores the encrypted off-site backups, runs DNS for qsnag.com and forwards email sent to our contact address. | EU for backups; Cloudflare's network for DNS and email |
| Resend | Sends the app's emails, such as invites, password resets and status changes. | Ireland |
| Sign in with Google, only if a customer turns it on and a person chooses it. | Google's network | |
| Anthropic | Reads plan images and photos of paper snag lists, only for customers who switch those features on. Images are not used to train its models. | United States |
We give customers at least 30 days' notice by email before adding or replacing a provider that handles their data.
GDPR and your data
- Roles. You are the controller of the data in your copy of Q Snag, and we are your processor. Our terms of service include a data processing agreement under Article 28 of the GDPR, which we send with every order form.
- You own your data. You can ask for a full export at any time: a database file plus every photo and plan. When you leave, we delete your data and confirm it in writing.
- No selling, no tracking. We do not sell personal data, show advertising or use analytics in the app.
- Transfers. Data stays in the EU unless you switch on the optional AI features, which send the images involved to Anthropic in the United States under the EU-US Data Privacy Framework or the EU standard contractual clauses.
- Privacy notice. Our privacy notice explains what we collect and why, for everyone who uses Q Snag.
Incidents
If a personal data breach affects your data, we tell you without undue delay, and within 48 hours of becoming aware of it, with what we know, so you can meet your own duty to report it to the Data Protection Commission within 72 hours. We then keep you updated and help you put it right.
Reporting a vulnerability
If you think you have found a security problem in Q Snag, please email gearoid@qsnag.com with the details. We reply within one working day and keep you updated until it is fixed. Please don't access other people's data, disrupt the service or make the problem public before we have fixed it. We won't take action against anyone who reports a problem in good faith this way.