How SnapMind protects your gym's data
Everything your IT and security team needs for a review, in one place: where data lives, who can see what, how we stay up, which providers we use, and the documents we send on request.
Owners see totals. Clients' coaching stays private.
A gym owner, admin or club manager sees how every club and trainer is doing: clients, sessions done, check-ins and replies waiting. They never see a client's messages, check-in answers, notes or videos. The database itself enforces this, so no screen, export, API call or webhook can reveal them.
- A trainer reads only their own clients' data. Every coaching table checks the client's own trainer on every read.
- The API, webhooks and exports identify clients by id, club and trainer. No names, contact details or content.
- When a trainer leaves, their clients stay with the gym and move to another trainer with their history.
Security at a glance
How SnapMind runs today.
The database, sign-in and file storage run on Supabase, on Amazon Web Services in Ohio. The website and API run on Netlify.
TLS for every connection; unencrypted requests are refused. Our hosting provider encrypts the database, files and backups with AES-256.
Access rules live in the database, next to the data, so a bug in an app screen cannot widen what someone sees.
Authenticator codes and trusted devices for every account. A company can require two-step for all staff with one switch.
Every change an owner, admin or manager makes is recorded with who and when, and can be downloaded from the company console.
Salted and hashed, never stored or emailed in plain text. API keys are stored as one-way hashes and shown once.
Each webhook has its own secret and every delivery carries an HMAC-SHA256 signature with a timestamp.
The database is backed up every day and backups are kept for 7 days.
The website, consoles, API, sign-in, database and webhook delivery are checked every 5 minutes, with alerts on any failure. See live status.
Certifications and reviews
Where SnapMind stands today, stated plainly.
| Item | Status | Notes |
|---|---|---|
| Security questionnaire | Available | Standard SIG Lite and CAIQ questions answered from how SnapMind runs. Sent on request. |
| Data processing agreement | Available | Sent on request, ready to sign. |
| Incident response plan | In place | Written plan with notification steps. Sent on request. |
| Payment card data | Stripe | Card numbers never touch SnapMind. Stripe handles payments under PCI DSS Level 1. |
| SOC 2 Type II | Not yet | Ask us for the current timeline. |
| Independent penetration test | Not yet | Ask us for the current timeline. |
| Point-in-time recovery | Not yet | Daily backups today. |
Providers that process data
The small set of companies SnapMind relies on, and what each one does.
| Provider | Purpose | Location |
|---|---|---|
| Supabase (on AWS) | Database, sign-in, file storage | United States (Ohio) |
| Netlify | Website, consoles and API hosting | United States, global edge |
| Stripe | Payments | United States |
| Resend | Email delivery | United States |
| Twilio | Approval, invite and trip text messages | United States |
| Anthropic | Plan building, meal estimates and file imports a user starts | United States |
| Cloudflare Turnstile | Bot check on sign-in and sign-up | Global |
| Expo, Apple and Google | Push notifications | United States |
| Google Workspace | SnapMind's own email and documents | United States |
Documents for your review
Email us and we send these the same day.
SIG Lite and CAIQ, pre-answered.
Ready to sign.
How we detect, contain and notify.
What we promise and how fast we answer.
Accessibility
The coach console, company console, status page, developer docs and sign-in pages are checked against WCAG 2.1 AA with automated testing in both light and dark mode, and we fix what fails before release. Every screen works with a keyboard, respects reduced motion and scales with browser text size. If something gets in your way, email us and we will fix it.
Policies
Security policy · Schools and student athletes · Privacy policy · Terms · API and webhooks · Status
Running a security review? Send us your questionnaire or ask for any document above. We also report security issues found by researchers; see the security policy for how.
Email the security team