Genie Snap Security and Architecture

What runs in production, independent security scan results, and the architecture behind it.

Genie Snap builds intake processes from a description or a Word or PDF document. People fill out a web form, and each submission fills in your original document, ready for signature. Every submission is tracked and routed from one dashboard and available to your other systems through the form's API, with nothing else to buy or build. You install it on your own servers: on-premises, in your cloud, or fully air-gapped.

What Runs in Production

✅ No AI in what runs: A language model can optionally draft the text for a new workflow, but it never builds or runs the form, API, or document. They are built from that text by fixed rules and run as standard HTML and JavaScript, so the same input gives the same result every time.
✅ Your data stays on your servers: Submissions, documents, signatures, and logs are stored only in your own database and file storage, which can be encrypted at rest. Email can go through an internal mail server, and Stripe is used only if you collect payments.
✅ Signing enforced by fixed rules: Signing order, field visibility, and completion are enforced, not inferred. Each signer signs in on every envelope with single sign-on or an emailed code, every delivery, sign-in, view, and signature is recorded with a timestamp and IP address, and the finished PDF is sealed with your organization's X.509 certificate so changes after signing are detectable. eSignature Guide →
✅ Standard hardware: Installs from a package of about 120 MB on Windows Server with IIS and SQL Server, or from the Windows Docker image. No GPU and no cluster to manage.
Security Verification

Tested the Way Your Security Team Will Test It

We run the hosted Genie Snap site through the same Qualys tools many security teams use for vendor reviews. These are the most recent results.

A+ Qualys SSL Labs
TLS configuration · August 27, 2026
  • A+ on every public endpoint, IPv4 and IPv6.
  • TLS 1.3 and 1.2 only. TLS 1.0, TLS 1.1, and all SSL versions are disabled.
  • Post-quantum hybrid key exchange (X25519MLKEM768) on TLS 1.3.
  • Forward secrecy and downgrade-attack protection.
  • HTTP Strict Transport Security with a long duration.
0 Medium, High, or Critical
Qualys Web Application Scanning, full scan · August 28, 2026

No findings at Qualys severity levels 3, 4, or 5. Five low-severity findings (levels 1 and 2):

  • Four are cookie attributes on third-party cookies set by the Stripe and Google Analytics scripts on the hosted site, not on Genie Snap's own session cookies.
  • One is a suspected path finding on a static, compressed favicon file.
0 Medium, High, or Critical
Qualys external network vulnerability scan · August 28, 2026

No findings at Qualys severity levels 3, 4, or 5 across the production servers.

The three level-2 findings are the same item on each server: the certificate name doesn't match when a server is contacted directly by IP address. That's expected, because the public hostname is served through a content delivery network rather than by IP.

What these results cover. These are automated scans of the hosted Genie Snap site. They are not a manual penetration test. A self-hosted installation runs the same application on your infrastructure, so its TLS, network, and server results depend on how your team configures that environment. Self-hosted installations don't include the Google Analytics tag.

Compliance.

  • A self-hosted install runs inside your own environment, under your organization's existing compliance boundary, controls, and audits.
  • Your team decides where data lives, who can reach it, how it is encrypted and backed up, and how long it is kept.
  • Self-hosted installs send no telemetry.
  • Because Genie Snap doesn't host self-hosted installs and has no access to them, certifications such as SOC 2 or FedRAMP apply to the environment you run it in rather than to a separate vendor service.
  • Source-code escrow can be arranged, so you keep access to the software if Genie Snap is ever unable to support it.

Full reports and security questions. Complete scan reports are available to prospective customers on request. To request them, ask a security question, or report a vulnerability, email [email protected].

Architecture

Runs Where You Choose

Genie Snap runs on standard servers on-premises or in a private or public cloud: Azure, AWS, IONOS, GCP, or any environment that meets the technical spec. It can run completely offline and air-gapped when your compliance requirements call for it, or connected for cloud hosting, public client access, and multi-tenant delivery. Each license is tied to your domain and database cluster.

Genie Snap architecture: optional AI drafting kept separate from the production runtime
Figure 1: An optional AI model only drafts the text for a new workflow. Building and running the workflow never uses a model.

Load Balancing and Performance

Deployments run under either load-balancing model below, not both at once — choose the one that fits your infrastructure.

Stateless Load Balancing Any server can handle any request, so you scale by adding servers behind a standard load balancer.
Sticky Session Load Balancing Each user stays on the same server, which keeps their session in that server's memory for faster responses.

View the On-Premises Load Test Report (PDF)

Small Footprint: In a load test on a single 4-core, 16 GB virtual machine, below the documented minimum, Genie Snap handled 100 concurrent users at about one submission a second, each creating a record and a 6-page PDF, with typical responses of 300–600 ms and no errors.

What It Costs to Run

  • The hosted Genie Snap online sandbox runs on this stateless, load-balanced design: two web servers and one database server on IONOS, with Wasabi object storage for documents and files.
  • Including Windows Server and SQL Server licensing, its infrastructure costs about $180 a month, with no per-GB charges for data sent out, and storage costs stay low as documents grow into terabytes.
  • Your own costs depend on your hosting provider and the SQL Server edition you license.
What You Get

Once you review and save a workflow, it produces standard outputs:

  • Standard HTML and JavaScript Forms
  • JSON Data Contracts
  • Print-Ready Word or PDF Documents
  • REST APIs With Version-Stamped Contracts
  • Sequential eSignature with an Audit Log and Certificate-Sealed PDFs

Every generated workflow uses the same API, with version-stamped contracts that keep working after a form is edited. See the API Reference →

See it work.

Try it free, no signup until you save →  ·  Technical details →  ·  Use cases →