v1.0 · last updated 1 August 2026
Security
Written to be read by whoever got handed the ticket, and to be attached to it afterwards. If something you need isn't here, email hello@kudosnap.com and it gets added.
what this is
kudoSnap is a peer-to-peer employee recognition app for Slack. It asks people a short question about a coworker, and delivers the answer to that coworker as a direct message with no name attached. It has no web-facing product surface that accepts input, and no public posting of any kind.
permissions
Seven Slack bot scopes, listed in full. No user scopes. No message-history scope of any kind, so message content is not readable by this application.
| Permission | What it lets us do | What it does not |
|---|---|---|
| channels:read | See which public channels exist and who's in them | Read a single message in any of them |
| groups:read | See who's in a private channel the bot was invited to | Read those messages, or see private channels it wasn't invited to |
| mpim:read | See who's in a group DM the bot is part of | Read those messages |
| users:read | See names, avatars, and timezones from the member directory | See email addresses — that's a separate scope we don't request |
| users.profile:read | Read the department field your Slack admin defined, so recognition can be grouped by team | Read profile fields we don't ask for, or any custom field's history |
| chat:write | Send you a DM and draw the app's Home tab | Post in any channel, public or private |
| team:read | See your workspace's name and email domain | See anything about the individuals in it |
Adding the workspace dashboard required no additional scopes — it is built entirely from votes cast inside kudoSnap.
what's stored
Per person: Slack user ID, display and real name, avatar URL, timezone, job title and department where the workspace defines those fields, channel membership as a derived weighting, questions delivered, and votes cast and received.
Per workspace: Slack team ID, workspace name, email domain, bot token, and install metadata.
Not stored: message content, email addresses of individuals, files, and free text of any kind — kudoSnap has no text input, so there is no user-authored content in the system.
subprocessors
- VercelApplication hosting and serverless execution
- SupabasePostgres database; all application data at rest
- PostHogProduct analytics; no vote or recognition content
- SlackSource of identity and delivery channel
No other processor receives workspace data. No data broker, no advertising network, no AI training pipeline.
data residency
Hosted on Vercel and Supabase. If your review needs the specific region on record, email hello@kudosnap.com and you'll get it in writing the same day.
encryption
In transit: TLS on every connection, to the application and between the application and its subprocessors. In use: Slack bot tokens are stored encrypted at rest by Supabase.
authentication
The workspace dashboard authenticates through Slack's OpenID Connect. Sessions are stateless signed JWTs in an httpOnly cookie, 30 day expiry, revoked by logout or expiry. There are no kudoSnap passwords, so there is no password database to breach.
Every dashboard request is scoped to the workspace in the session token. There is no cross-workspace query path.
retention and deletion
Removing kudoSnap from Slack revokes its token and stops all delivery immediately.
Deletion of stored data is currently a manual process: email hello@kudosnap.com and the workspace and everything belonging to it is deleted within seven days, with written confirmation. Automatic deletion on uninstall is not yet implemented. It is being built, and this entry changes the day it ships.
Individual deletion on the same terms, by the same route. Deletion cascades — users, votes, recognitions, deliveries, and derived cards all go with the workspace row.
export
None. There is no export function in the product, for administrators or for us, in any format. This is a design property rather than a policy: no code path produces person-linked output.
SOC 2
No. kudoSnap does not have a SOC 2 report, and claiming otherwise or implying one is in progress would be the wrong way to start this relationship.
What exists instead: a permission set narrow enough that message content is unreadable, no export path, no password store, a single named person accountable for the system, and this document. For many reviewers that is not sufficient, and that's a legitimate conclusion to reach.
If a SOC 2 is a hard requirement for your workspace, say so — that is useful information and it's the thing that would move it up the list.
DPA
Not available as a standard document yet. Email hello@kudosnap.com with what your legal team needs and you'll get a real answer rather than a redirect.
incident contact
hello@kudosnap.com. One person, usually within a day, faster for anything described as a security issue. Affected workspaces are notified directly.