Effective: August 22, 2026
1. Purpose and scope
This policy describes our current, risk-based approach to protecting the GetLoopLoop service and the process for reporting a potential security issue.
It is a transparency document, not a representation that the service is certified to a particular framework or that it meets a particular customer security standard.
2. Security practices
We use access controls, encrypted transport, logging, rate limits, and provider management appropriate to the service. We review changes and operational risks as the product evolves.
Access to production systems and customer data is limited to people and services with a legitimate operational need. We rely on infrastructure and AI providers for parts of the service, and assess those providers in proportion to their role and the data involved.
3. Customer responsibilities
Keep account credentials confidential, use strong authentication where available, limit workspace invitations to authorized people, and do not place secrets or sensitive data into prompts unless you are authorized to do so.
Contact us promptly if you believe an account or workspace has been compromised.
4. Reporting a vulnerability
Send a clear report to getlooploop@gmail.com with the affected URL or feature, reproduction steps, impact, and any relevant evidence. Do not include passwords, access tokens, or personal data that are not necessary to explain the issue.
Please give us a reasonable opportunity to investigate and remediate before public disclosure. Do not access, modify, delete, or exfiltrate data; do not degrade service availability; and do not test systems outside assets you are authorized to test.
5. Incident response
We investigate credible reports, contain confirmed issues, and assess any notification obligations with regard to the applicable law and the facts of the incident. We will communicate with affected customers when required or appropriate.
This document is provided for transparency and does not replace advice from your counsel. Enterprise customers may execute a signed order form with supplemental terms.