Security

Accounts

Passwords are hashed with argon2id. Sessions are random tokens stored only as a SHA-256 digest, so a stolen database backup yields no usable sessions. Password reset and invitation links are single-use, expiring, and stored the same way. Sign-in attempts are rate limited per address.

Isolation

Every query is scoped to the tenant that owns the data, and a dedicated test suite exists solely to prove one customer cannot read another's.

In transit and at rest

HTTPS everywhere, with HSTS. AI provider keys are encrypted before they are written to the database.

Reporting something

Mail us and we will answer the same working day.

This page describes how locoloop works today. The formal, countersignable document is being prepared with counsel ahead of launch — if you need it for a procurement or security review now, write to us and we will send the current draft.

Start free or talk to us →