Security
Families trust you with their kids.
We treat their data that way.
A snow school holds children's names, ages, medical notes and emergency contacts, along with staff records and payments. This page lists how SnoDesk protects them and how to reach us if something looks wrong.
Principles
How we think about it.
Least access, always
Every staff member sees only the screens their role needs. Instructors see their own lessons and students, not the whole guest list.
Your data stays yours
We don't sell it, share it, combine it with other customers' data or use it to train AI models. You can download a full copy at any time and ask us to delete what we hold.
You hear it from us first
If an incident affects you, we tell you directly with what happened, what it touched and what we're changing.
Controls
What's in place.
| Control | What it means |
|---|---|
| Dedicated instance | Each ski area gets its own application and its own database. No other customer's data is on it. |
| Encryption | HTTPS on every page, with plain HTTP redirected. The database only accepts encrypted connections, and the database and its backups are encrypted at rest. |
| Card payments | Cards are entered on Stripe's secure payment page. Card numbers are never sent to or stored by SnoDesk. |
| Guest sign-in | Families sign in with a one-time code sent to their email, so there are no guest passwords to leak or reuse. |
| Staff sign-in and roles | Staff accounts are created by your administrator only. Six roles (admin, manager, desk, cashier, rentals, instructor) control what each person sees, with per-person permissions on top. Sessions use signed cookies, and quick-PIN sign-in can be turned off. |
| Change history | Changes to bookings, payments, schedules, pay rates and settings are recorded with who made them and when. |
| Staff checks | Certifications, first aid and background checks are tracked with expiry dates, and the office and the instructor are warned before one lapses. |
| Secrets | Database passwords, payment keys and signing keys are kept in a managed secrets vault, never in code. |
| Backups | Automated daily database backups kept for up to 30 days, plus a full data export your admin can download from settings. |
Hosting and subprocessors
Where SnoDesk runs, and who touches it.
Canadian ski areas are hosted in Amazon Web Services' Canada (Central) region. These are the outside services involved in running SnoDesk.
| Service | What it does | When |
|---|---|---|
| Amazon Web Services | Hosting, database, backups and outgoing email | Always |
| Stripe | Card payments and refunds | When you take card payments |
| Twilio | Text messages to guests and staff | When you turn on SMS |
Report a concern
Seen something that doesn't look right?
Email info@geminilogic.com with "security" in the subject, or call (905) 625-7212. We'll also complete your security or privacy questionnaire as part of an evaluation.
Have a questionnaire? Send it over.
We'll fill it in and walk your IT or privacy lead through how SnoDesk handles guest and staff data.