Security

Last updated: 26 October 2026

Report a security problem

If you think you have found a vulnerability in Snapfile, or that your data has been exposed, email hello@snapfile.uk with “Security” in the subject. Please include what you found and how to reproduce it. We will acknowledge your report within two working days and keep you updated until it is fixed. Please do not access other people's data or disrupt the service while testing.

How your data is protected

• In transit: every connection to snapfile.uk uses HTTPS, with HSTS so browsers never fall back to plain HTTP.
• At rest: receipt and invoice images, your phone number and any HMRC sign-in tokens are encrypted by Snapfile before they are stored. Your records are held in a database in London; the app runs in Frankfurt.
• Your HMRC password: Snapfile never sees or stores it. If you connect to HMRC, you sign in on HMRC's own site and Snapfile receives a token that you can revoke at any time.
• Signing in: the web dashboard uses one-use links sent to your WhatsApp, valid for 15 minutes. There are no passwords to leak.
• Separation: every request is checked against your own account, so one customer can never see another's records.
• Your control: you can export your records at any time (reply export) and permanently erase everything (reply delete my data).

If something goes wrong

If a personal data breach affects you, we will tell the Information Commissioner's Office within 72 hours of becoming aware of it, as UK GDPR requires, and tell you directly on WhatsApp without undue delay where there is a high risk to you. Where HMRC data is involved, we will also tell HMRC.