01Encryption
All traffic between you, our applications and our APIs runs over TLS 1.2 or higher. Data at rest, including call recordings and transcripts, is encrypted with AES-256. Call media between our platform and our carriers is encrypted in transit.
02Access control
Access to production systems is limited to the engineers who need it, is granted on a least-privilege basis, and requires multi-factor authentication. Administrative actions are logged. We review access on a regular cadence and revoke it promptly when someone changes role or leaves.
Inside your workspace you control who sees what, through per-seat roles for your acquisition managers.
03Infrastructure
Loopless runs on major cloud providers in US regions, in isolated environments with network-level segmentation between them. We patch regularly, and we do not run customer workloads on shared credentials.
04Recordings and retention
Recordings and transcripts are stored against your workspace and retained for the window your plan defines, then deleted. You can delete a recording at any time, and deletion removes it from backups on our standard backup rotation.
05Subprocessors and AI providers
We use vendors for hosting, telephony, speech recognition, language models, monitoring and email. They are bound by contract to use your data only to provide their service to us. We do not permit our model providers to train on your data.
06Monitoring and response
We monitor for availability, anomalous access and error conditions, and we keep an incident response process with named owners. If a security incident affects your data we will notify you without undue delay, tell you what we know, and follow up with a written summary of cause and remediation.
07Compliance posture
Our platform is built around the calling and consent obligations our customers carry, including TCPA, with quiet hours, opt-out capture and consent records available on every agent. Formal certification work is underway; if you need our current status for a vendor review, write to us and we will share it.
08Your part
Security is shared. Use strong, unique credentials and turn on multi-factor authentication. Give each teammate their own seat rather than sharing one. Remove access when someone leaves your team. Only import contact data you have a lawful basis to hold.
09Reporting a vulnerability
If you believe you have found a vulnerability, email raza@looplessai.com with enough detail to reproduce it. We will acknowledge it, keep you updated, and will not pursue action against researchers who report in good faith and avoid privacy violations or service disruption.
Write to raza@looplessai.com and we will get back to you.