SnagSwift does not claim SOC 2, ISO 27001, or third-party audit certifications that have not yet been formally audited and completed. Technical statements below describe our current active application architecture.
1. Authentication & Identity
User identity is secured using token-based session management with modern cryptographic hashing. All credential exchanges enforce HTTPS and strict transport policies.
- Password Standards: Salted and hashed using modern key-derivation algorithms (bcrypt/argon2).
- Session Integrity: Encrypted, HttpOnly, SameSite cookies and signed bearer tokens prevent credential interception.
- Multi-Factor Authentication: [VERIFICATION REQUIRED: Production rollout schedule for optional SMS/Authenticator app 2FA across all tenant accounts].
2. Project Access & Permissions
SnagSwift employs strict multi-tenant isolation and role-based access control (RBAC):
Role Separation
- Architect / Lead Inspector: Full project control, drawing uploads, issue authority, and close-out sign-off.
- Project Manager / Main Contractor: Master project view, trade assignment coordination, and status tracking.
- Subcontractor / Trade: Scoped exclusively to the specific snags assigned to their organization. They cannot view unrelated tenant projects or confidential items.
3. Data in Transit & Cloud Storage
All communication between client applications (Web, iOS, Android) and SnagSwift backend servers is encrypted in transit using industry-standard TLS 1.3 / TLS 1.2.
- Drawing & Photo Storage: High-resolution architectural drawings and snag defect photographs are stored in secure object storage with access governed by short-lived pre-signed URLs.
- Database Infrastructure: Relational PostgreSQL and document records utilize encrypted volume storage at rest.
- Hosting Region: [VERIFICATION REQUIRED: Primary cloud hosting provider datacenter region e.g. AWS eu-west-1 / Google Cloud Europe / South Africa local edge].
4. Offline Local Data & Safe Sync
Field operations require inspecting in basements, steel-reinforced shafts, and remote sites where internet connectivity is intermittent or absent.
Offline Security Architecture
Local data is stored in sandboxed mobile storage (SQLite/IndexedDB). When an inspection takes place offline:
- Snags and photos remain isolated within the application container sandbox on the user's device.
- Conflict resolution handles reconciliation when connectivity resumes, ensuring offline updates do not overwrite concurrent team records.
- Upon explicit user logout, cached local tenant credentials and temporary inspection state are sanitized.
5. Data Deletion, Retention & Export
Your project records belong to your practice:
- Customer Export: Authorized administrators can export their full project defect schedules and photographic records to PDF and standard CSV formats at any time.
- Tenant Deletion: Upon project closure or contract termination, tenant data deletion can be requested in accordance with applicable data privacy statutes (POPIA & GDPR).
- Backup Retention: [VERIFICATION REQUIRED: Specific automated snapshot frequency and off-site backup retention window].
[VERIFICATION REQUIRED: Independent penetration testing engagement and formal SOC 2 Type I readiness assessment schedule to be published upon completion of ongoing pilot cohorts.]