A summary of the controls behind the product. For a vendor review, email hello@looph.ing and we will answer your security questionnaire.
Infrastructure and isolation
The service runs on DigitalOcean, with the database and file storage on Supabase, in the United States. Every database table has Postgres row-level security, and our server code checks workspace membership on every request, so one customer's data stays separate from another's.
Encryption
All traffic uses TLS 1.2 or above, and the app and its sign-in pages send HSTS. Our hosting and database providers encrypt data, files and backups at rest with AES-256. We also encrypt integration credentials ourselves with AES-256-GCM, and that key can be rotated without downtime.
Access control
Members and admins sign in with an email and password or with Google, and can turn on two-factor authentication. Single sign-on and SAML are not available yet. The workspace owner decides what admins and members can each do, area by area.
On Growth and Business, the owner can require two-factor authentication for admins and limit team invites to allowed email domains, and Business adds an admin IP allowlist. Audit history is visible for 7 days on Free, 30 days on Starter, 90 days on Growth, 365 days on Business, and audit entries are deleted after one year.
Staff use of our internal console is role-based. Every administrative action there is logged, and destructive actions need a written reason.
Resilience
The database is backed up automatically every day, and backups age out within 30 days. A written disaster-recovery runbook covers restoring them, and a written incident policy covers who is told and when.
Application security
Every change passes automated type checks, lint and tests before it is deployed. The widget, the browser-extension API, image uploads, data exports, rewards and account actions are rate-limited, and sign-up is protected by a CAPTCHA.
Responsible disclosure
Report a vulnerability to hello@looph.ing. We acknowledge reports within one business day. We will not take legal action over good-faith research that respects customer data, and we credit reporters who want credit.