Security at SurfaceLoop

We build a security product - we hold ourselves to the standard we measure our customers against.

Infrastructure

SurfaceLoop runs on isolated cloud infrastructure with encryption at rest and in transit. All scan data is processed in memory and stored encrypted.

Data handling

Scan results are tied to your account and never shared. We retain data only as long as your account is active. You can export or delete your data at any time.

Authentication

All accounts are protected by bcrypt-hashed passwords and optional two-factor authentication. Session tokens are short-lived and rotated automatically.

Responsible disclosure

If you discover a security issue in SurfaceLoop, please report it to security@surfaceloop.com. We commit to acknowledging reports within 48 hours.