Security

Last updated: September 18, 2026

1. Your Data Stays Your Company's

  • Tenant isolation in the database. Every request runs as a restricted database role, and row-level security in PostgreSQL decides which company's rows it can see. Isolation is not left to application code alone.
  • Permissions down to fields and records. Administrators decide what each role can see and do, and those rules apply to people and AI agents alike.
  • Approvals and separation of duties. On Business, the person who creates a change cannot also approve it.
  • Audit trail. Changes record what changed, when, and who or which agent made them.

2. Accounts

  • Passwords are stored as bcrypt hashes, never in readable form.
  • Email addresses are verified before an account can be used.
  • Resetting a password signs the account out everywhere else.
  • Sign-in with Google or GitHub is available.

3. Infrastructure

  • All traffic is encrypted in transit with TLS.
  • Servers run on Hostinger in Malaysia, behind Cloudflare. Databases and internal services are not reachable from the internet.
  • Files are stored on our own servers, not with a third-party storage provider.

4. AI and Personal Data

  • Email addresses, phone numbers, card numbers, national ID numbers and bank account numbers are masked before any text is sent to an AI model provider.
  • Agents act with the permissions of the role they work for, and changes they prepare need a person's approval.
  • Monitoring traces never contain the text of questions, answers or the records an agent reads.
  • Logs replace personal data before it is written.

5. Reporting a Vulnerability

If you believe you have found a security vulnerability in Loopency, email [email protected] with "Security" in the subject line, the steps to reproduce it, and its impact.

We ask that you:

  • Give us reasonable time to fix the issue before disclosing it publicly.
  • Do not access, change or delete data that is not yours; use accounts you own.
  • Do not run denial-of-service tests, spam, or social engineering against our staff or customers.

If you follow these guidelines and act in good faith, we will not pursue legal action for your research, we will respond to your report, and we will tell you when the issue is fixed. We do not currently run a paid bug bounty.

6. Contact

Security questions: [email protected]

Security - Loopency