Security

Every customer-owned table enforces row-level security keyed to the authenticated user, with explicit database grants per role. Application code never queries across tenants; privileged database access is limited to server-side jobs that verify the caller first.

All traffic is served over TLS. Data at rest is encrypted by our infrastructure provider. Advertising platform credentials are encrypted with a dedicated key before being stored and are never returned to the browser.

• Roles are stored in a dedicated table and checked server-side on every request.
• Administrative screens require an admin role; there is no client-side admin flag.
• Customers can enable TOTP two-factor authentication and sign out of all sessions from Privacy & data in settings.
• Internal access is reviewed periodically and each review is recorded.

Security-relevant actions — sign-in changes, role grants, credential updates, publishing, approvals, exports, and deletions — are written to an append-only audit log with actor, IP, user agent, and a redacted change record. Secrets and tokens are stripped before storage. The log cannot be edited or deleted from the application.

Public tracking endpoints enforce IP rate limits and body-size caps. AI generation is capped by daily per-account budgets. Guardrails automatically pause ads and tests on spend spikes, CPA breaches, or dead landing pages.

The primary database is backed up continuously by our infrastructure provider with point-in-time recovery. Backups are encrypted and expire within 30 days, which is also the outer bound for data removal after an account purge.

Our infrastructure and model providers are listed on the sub-processors page. We update that page before adding a provider that processes customer data.

Loop is not currently SOC 2 certified. We have implemented the in-product controls an audit depends on — audit logging, access review, retention and deletion, and job monitoring — and can share our control documentation on request during a security review.

Email security@loopoptimizations.com with steps to reproduce. We acknowledge reports within two business days and will not pursue legal action for good-faith research that avoids privacy violations, data destruction, and service degradation. Please do not test against other customers' accounts or websites.