Security

Last Updated: July 8, 2026

1. Our Commitment to Security

Security is a top priority at SnowCoder. We implement comprehensive security controls to protect your data, your ServiceNow credentials, and the integrity of our platform. This page describes the controls and standards we operate against today.

2. Commercial guarantees, in plain English

The four operating principles below are not engineering trade-offs - they are guarantees we make to every customer. They are how SnowCoder behaves by design.

• Per-tenant isolation: Each customer has their own ServiceNow instance record. The credentials we hold are encrypted at rest with a per-record salt - even if the database were breached, the passwords aren’t readable as plain text.
• Two clearly separated lanes: Humans work interactively in Yeti Chat; AI agents do their work on schedules. No accidental crossover between operator actions and agentic activity.
• Destructive-change confirmation: “Looks like it deployed” isn’t enough. In the SnowCoder web application, destructive operations are held for explicit human approval before any deploy – no surprise deletions. (Headless API keys can be configured to auto-approve for unattended pipelines – see section 6.)
• Token budget is a hard stop: A misbehaving agent cannot burn through your money. The budget is a hard stop, not a polite warning. The heal loop caps spend per build (HealBudget) before any retry exhausts the balance.

3. Compliance status

• GDPR: We comply with GDPR as a data processor; Data Processing Agreement available. For Enterprise+ deployments, data residency can be pinned to a customer-nominated AWS region (EU regions available).
• OWASP Top 10: We develop against the OWASP Top 10 (account lockout per CWE-307, CSRF protection, input validation, encoded output) as part of our secure-development practices.
• PCI DSS: Compliant via Stripe (PCI Level 1 certified). No card data is stored in our application.
• NIST 800-63B: Compliant (12+ character passwords, bcrypt 12 rounds, timing-safe comparison).
• SOC 2 Type II: Not yet certified; actively working toward it (implementing controls and selecting an audit partner).
• ISO 27001:2022: Not yet certified. An internal readiness self-assessment indicates approximately 78% of Annex A controls are implemented; ISMS documentation is underway and we are actively working toward certification.

Internal security assessment score: 82/100 (Grade B), February 2026 (internal review, not an independent audit).

Request the full Security Pack →

4. Data protection

• At rest: AES-256-GCM with per-record random salt and PBKDF2 key derivation (100,000 iterations). Authentication tags prevent tampering.
• In transit: TLS 1.3 minimum.
• ServiceNow credentials: encrypted before storage; decrypted in-memory only during authenticated API calls.
• AI processing: all Claude API calls routed through Cloudflare AI Gateway for audit logging, cost control, and rate limiting.

5. OAuth 2.1 with secret rotation

All programmatic access to SnowCoder uses OAuth 2.1 with PKCE (S256 code challenge) - the same standard banks use for high-value transactions.

• Dynamic Client Registration (RFC 7591) - MCP clients self-register; no manual onboarding.
• Refresh-token rotation - every refresh issues a new access and a new refresh token. Old tokens expire immediately.
• Replay-attack detection - if a refresh token is replayed (e.g. stolen), SnowCoder revokes the entire token chain, invalidating both the legitimate token and the stolen one. The user is forced to re-authenticate.
• Granular scopes - six scopes (mcp:read, mcp:write, kb:read, projects:read / projects:write, builds:read / builds:write) so MCP clients receive only the permissions they need.

6. API keys for server-to-server access

For headless agents, scripts, or CI pipelines, SnowCoder supports bearer API keys issued from the SnowCoder UI. Each key:

• Carries the issuing user’s identity and project scope.
• Format sk_live_<22-char-prefix>.<32-char-secret> - only the prefix is stored after creation.
• Can be revoked instantly from the UI; revocation is effective on the next request.
• Has an optional allow_auto_approve toggle for unattended build pipelines.
• All requests are audit-logged with user, IP, and key identifier.

7. Edge & infrastructure security

• Cloudflare Zero Trust with JWKS JWT verification for admin access.
• Cloudflare WAF with OWASP rules.
• Cloudflare Turnstile (bot protection, fail-closed).
• Cloudflare DDoS protection (L3-L7).
• DNSSEC enabled.
• Admin layers: Cloudflare Zero Trust + email allowlist + rate limiting + comprehensive audit logging.
• Infrastructure: AWS with VPC isolation. For Enterprise+ dedicated deployments we provision in a customer-nominated AWS region, with in-region AI (via AWS Bedrock) delivered as part of the engagement for customers needing to avoid cross-border AI transfers.

8. What we log

Every privileged action - admin login, configuration change, build approval, deploy, ServiceNow credential change - is logged with:

• User identity (or API key identifier)
• IP address + timestamp
• The action performed and target object

Logs are retained for 90 days (longer on enterprise plans). Available for export via the SnowCoder UI or programmatically via MCP.

9. Security Assurance Pack

We maintain a detailed Security Assurance Pack that documents our security architecture, controls, policies, and compliance measures. This document covers:

• Infrastructure and architecture security
• Data protection and encryption practices
• Authentication and access control mechanisms
• Network security and monitoring
• Incident response procedures
• Compliance with industry standards
• Internal security assessments

Need our full security questionnaire pre-filled? Most enterprise security teams ask for it. We have one ready. Reply to security@snowcoder.ai - we send it the same day.

DPA, control matrix, and vulnerability disclosure policy – available on request under NDA.

10. Contact

Team	Email
Security	security@snowcoder.ai
Enterprise Sales	Request enterprise pricing · enterprise@snowcoder.ai
General	hello@snowcoder.ai

11. Reporting security issues

If you discover a security vulnerability, please report it responsibly to security@snowcoder.ai. We take all security reports seriously and will respond promptly.