Security isn't a feature. It's the foundation.
8 layered security systems. 32 feature flags. 3 threat modes. Built for the most security-conscious teams in the world.
Zero Transcript Storage
Audio files are processed and permanently deleted within 7 days. We never store raw recordings. Your transcripts and actions live only in your workspace — nowhere else.
HMAC Authentication
Every API request is signed with SHA-256 HMAC with timestamp-based replay protection. Unsigned or expired requests are rejected automatically.
Threat Fingerprinting
Loopion recognises bad actors even when they switch IPs or devices. Each request is scored 0–100 on risk. High-risk actors are automatically throttled or blocked.
Stealth Containment
When a threat is detected, it's contained silently. Attackers receive normal-looking responses while their actions are logged and neutralised. They never know they've been caught.
Rate Limiting
Adaptive rate limits with soft and hard thresholds protect against abuse. Legitimate users are never affected. Burst detection handles sudden spikes intelligently.
Circuit Breaker
Three threat modes — Normal, Elevated, Lockdown — automatically engage based on threat levels. If something goes wrong, the system locks down before damage spreads.
Attack Simulation
8 simulation types let you test your own workspace defences. Replay attacks, brute force, privilege escalation, injection — verify your posture before an attacker does.
Self-Healing Recovery
Three-tier recovery automatically diagnoses and fixes processing failures. No manual intervention needed. Your pipeline recovers before you even notice.
Your data, protected at every level
Encryption
- • AES-256-GCM encryption for sensitive data at rest
- • TLS 1.3 for all data in transit
- • Encrypted OAuth token storage
- • No plaintext secrets in logs or errors
Access Control
- • Role-based access (admin, member, viewer)
- • 5-hour forced session expiry
- • CSRF protection on all mutations
- • Session binding with hardware fingerprint
Infrastructure
- • EU data residency (Supabase eu-north-1, eu-west-1)
- • Edge network via Vercel
- • Azure Container Apps for compute
- • Automated backups with point-in-time recovery
Monitoring
- • Real-time security event logging
- • Health score per meeting pipeline
- • Automated alerting on anomalies
- • Full audit trail for all operations
Compliance & certifications
GDPR
Full compliance with EU General Data Protection Regulation. Data stored in EU. DPA available.
UK DPA 2018
Compliant with UK Data Protection Act 2018. ICO registered.
SOC 2 Ready
Architecture designed for SOC 2 Type II certification. Audit trails, access controls, and monitoring in place.
ISO 27001 Aligned
Security controls aligned with ISO 27001 information security management standards.
Need to talk security?
Our team is ready to answer your security questions and provide documentation.