Security overview
Evidence stays account-bound.
Pepaco Systems LLC operates SnagAction and applies the controls described here to the current service.
Responsible operator
Pepaco Systems LLC operates the SnagAction software platform. Security or data concerns can be submitted through the contact form and will be recorded for review by the operator.
Pepaco Systems LLCLimited Liability Company · Formation no. 2643682Sharjah Media City Free Zone Authority (Shams) · Licence no. 2643682.01Shams Business Center, Sharjah Media City Free Zone, Al Messaned, Sharjah, United Arab EmiratesContact Pepaco about SnagActionAuthentication and ownership
Protected requests use a signed, HttpOnly SnagAction session created after an email code is verified. Project, report and photograph queries check that identity on the server; client-side buttons are not treated as authorization.
Storage
Structured records and ownership metadata are stored in the site database. Photograph bytes are stored separately in private object storage. Photograph delivery checks the requesting owner before reading the object.
Uploads and deletion
Uploads are limited to supported image types and sizes. Larger files are transferred in bounded chunks. Project and account deletion remove associated records and stored photograph objects; confirmation is required for destructive actions.
AI data minimisation
The AI drafting endpoint is server-side and requires authentication. It sends the smallest relevant text fields, disables response storage in the API request and never asks the model to decide severity, responsibility or repair acceptance.
Current limitations
- No independent security audit has been completed.
- Temporary offline copies can remain on a device controlled by the user.
- Voice notes currently remain temporary in the active browser session.
- Contractor portals are not active.
Report a security or data concern through the private request form.