Security

1. Infrastructure

GanttSnap is built on managed cloud infrastructure provided by Vercel (serverless functions and web hosting) and Supabase (database). Both providers operate on Amazon Web Services (AWS) in the EU (Ireland), ensuring your data stays within the European Economic Area.

By running on PaaS/Serverless infrastructure, we benefit from the security controls, physical access management, network isolation, and compliance programmes maintained by these providers, without operating any servers ourselves.

2. Data Encryption

All data is protected in transit and at rest:

• In transit — all connections to GanttSnap services use TLS 1.2 or higher. Unencrypted HTTP connections are not accepted.
• At rest — account and license data stored in Supabase is encrypted at rest using AES-256.
• Payments — all payment data is handled exclusively by Stripe. We never receive, process, or store card details.

3. Access Controls

Access to production systems and customer data is strictly limited. API keys, database credentials, and service secrets are stored in secure environment variable stores and are never committed to source code or version control. Access is protected by strong passwords and multi-factor authentication (MFA) on all critical systems including code repositories, DNS management, and credential stores.

4. Vulnerability Management

GanttSnap relies on the vulnerability scanning and patching programmes of our infrastructure providers — Vercel, Supabase, and Stripe — all of whom conduct regular security assessments of their platforms. Application dependencies are reviewed and updated on a regular basis. Our development practices take into account common vulnerability classes including those described in the OWASP Top 10.

5. Incident Response

We maintain a documented incident response process. In the event of a security incident affecting customer data:

• Detect — incidents are identified through infrastructure alerts and log monitoring provided by our cloud providers.
• Contain — affected systems or access are isolated immediately to limit the scope of the incident.
• Assess — the nature, scope, and impact of the incident are determined.
• Notify — affected users and relevant supervisory authorities (including the Dutch Autoriteit Persoonsgegevens) are notified within 72 hours of detection, in accordance with GDPR requirements.
• Remediate — root cause is identified and resolved. A post-incident review is conducted to prevent recurrence.

To report a suspected security issue, please contact us immediately at info@ganttsnap.com.

6. Data Retention and Disposal

We retain account and license data for as long as your account is active. Upon account termination or deletion request, your personal data is deleted within 30 days. Schedule data is never stored by us and requires no disposal process.

For more detail on what data we collect and how we use it, see our Privacy Policy.

7. Sub-processors

We share limited customer data with the following sub-processors, each bound by data processing agreements:

• Supabase — account and license data storage. Hosted on AWS EU (Ireland). supabase.com/privacy
• Stripe — payment processing. stripe.com/privacy

We do not share customer data with any other third parties.

8. Contact

For security-related questions or to report a vulnerability, please contact:
GanttSnap
2133 JC Hoofddorp, Netherlands
info@ganttsnap.com