Security at Snoika
If you're comparing AI visibility platforms on how they handle your data, Snoika security covers General Data Protection Regulation (GDPR) coverage and EU hosting. Encryption and a signed Data Processing Agreement (DPA) complete the four things buyers check first. This page explains how each one works. It also lists our access to the analytics you connect or to your DNS or CMS, and the questions to ask any vendor before you give them that access.
Security at Snoika
We encrypt every credential and file you connect to Snoika, with AES-256 at rest and TLS 1.3 in transit. So an analytics token stored on our side is saved as ciphertext, and data moving between your browser and our servers uses the current version of the transport protocol. We also run regular penetration tests in which people simulate an outside attack on the platform so we find the weak points first. When you compare vendors, ask them to name the encryption algorithm and the protocol version. A phrase like "bank-grade encryption" gives you nothing you can verify.
Data Snoika processes
The two kinds of data we handle are contact details for your team and the access your team grants to the platform.
Contact details for your team
As a B2B SEO solutions provider, we collect only what we need to communicate with your representatives. For most clients, that's the only personal data they send us directly.
Access you grant to the platform
The platform works with your website content and the accounts you connect during onboarding. We ask for Google Analytics 4 (GA4) and Google Search Console access at the start. We ask for Google Tag Manager access at the same time. CMS access comes later, and only if we'll be publishing pages for you.
| Access | What it's for | When we ask | How you remove it |
|---|---|---|---|
| GA4 | Measuring traffic to pages | Onboarding | Admin, then Property access management |
| Search Console | Search impressions and queries | Onboarding | Settings, then Users and permissions |
| Tag Manager | Tracking tags | Onboarding | Admin, then User Management |
| DNS connection | Serving pages in a subfolder | Before publishing | Delete it at your DNS provider |
| CMS | Publishing approved pages | Before publishing | Remove our user in the CMS |
GA4
- What it's for
- Measuring traffic to pages
- When we ask
- Onboarding
- How you remove it
- Admin, then Property access management
Search Console
- What it's for
- Search impressions and queries
- When we ask
- Onboarding
- How you remove it
- Settings, then Users and permissions
Tag Manager
- What it's for
- Tracking tags
- When we ask
- Onboarding
- How you remove it
- Admin, then User Management
DNS connection
- What it's for
- Serving pages in a subfolder
- When we ask
- Before publishing
- How you remove it
- Delete it at your DNS provider
CMS
- What it's for
- Publishing approved pages
- When we ask
- Before publishing
- How you remove it
- Remove our user in the CMS
GDPR as an EU company
Yes, our AI visibility platform runs under the GDPR. Snoika OÜ is an Estonian company and processes personal data under that regulation, and Estonia's Data Protection Inspectorate (Andmekaitse Inspektsioon) is our supervisory authority. Our DPA is available to customers. Under Article 28, the GDPR requires a written contract with every processor, and the same obligations pass down to subprocessors. The DPA is the document to check for subprocessor terms. Regulators can fine serious breaches up to €20 million or 4% of worldwide annual turnover, whichever is higher.
Where data is hosted
We store customer data in EU-based data centers. When a vendor sends personal data outside the EU, it needs an extra legal basis for that transfer, and your legal team then has to review it. If you're comparing vendors, ask where both their backups and their main database are stored.
Account access control
Inside Snoika, every team member works under role-based access controls, which means each person sees only what their job needs. Multi-factor authentication protects each login. Audit logging records every action. On your side, give us the narrowest role each tool offers. In GA4, read access is enough for reporting. In Search Console, a restricted user can see performance data but can't change your settings.
Protecting DNS access
We publish on your own domain through a DNS connection that puts pages without a migration. DNS access matters because whoever controls your DNS records controls where your domain points. Keep multi-factor authentication turned on at your registrar, and if your provider allows it, grant access only to the records we need. You also review and approve every page in the dashboard before it goes live.
Protecting CMS access
When we publish through your CMS, set up a dedicated account for us with an editor role instead of handing over an admin login. Our publishing works on any CMS. A separate account lets you see in your CMS logs which changes came from us. Remove that account the day the work ends.
Your data rights
You can ask us for access to your personal data, and you can ask us to correct or delete it. You can also complain to the supervisory authority in your EU Member State, a right set out in GDPR Article 77. The authority has to keep you informed of how your complaint progresses and how it ends. These rights apply on every plan, and they're the part of Snoika security you can test yourself.