Security & Trust

ThreatLoops reads public sources and compares them to a list of product names you type in. There is no agent to install, no API keys to hand over, no network access, and no read-only role to grant in your tenant.

That means the worst case for a ThreatLoops compromise is disclosure of your email address and the names of products you run — not access to your environment.

• sign-in is by emailed magic link — there are no passwords for us to leak or for you to reuse
• sessions are held in the browser and expire; signing out revokes them
• each account only ever sees its own stack, clients, team and saved items
• administrative capability is held in a separate roles table and checked server-side, never inferred from anything the browser sends

Every table holding customer data has row-level security enabled in the database, with policies that scope rows to the signed-in user or their team. Privileged operations run only inside server-side code after the caller's identity and role have been verified.

The shared intelligence catalogue — advisories, vulnerabilities, vendor status, end-of-support dates — is read-only to accounts and contains no customer data.

All traffic is served over HTTPS. The managed database and its backups are encrypted at rest by our hosting provider. Secrets and API keys are held in the platform's secret store and are only readable by server-side code, never by the browser.

We use a small number of providers to run the service:

• cloud hosting and managed Postgres — application hosting, database, authentication
• Paddle.com (Merchant of Record) — subscriptions, tax, invoices; holds card data so we do not
• email delivery — sign-in links and service notices
• AI model provider — summarising public advisory text

Outbound requests to security sources and vendor status pages are made from our servers, not your browser, so your IP address is never exposed to them.

AI is used to explain public advisories in plain English and suggest a first step. Only public source material is sent to the model. Your email address, stack, client names and team membership are excluded, and nothing you enter is used for model training.

AI spend is capped daily and monthly in code, which also bounds how much of anything can ever be sent.

• ingestion runs on a fixed schedule; every run is logged and surfaced on the in-app health view
• dependencies are monitored for known vulnerabilities and patched
• automated security scanning runs against the application and its database policies
• retention limits are enforced automatically rather than by hand

We are responsible for keeping the application, its database policies and its infrastructure secure, and for handling your data as described in the Privacy Policy.

You are responsible for controlling who has access to the mailbox used for sign-in, for the accuracy of the stack you enter, for keeping client workspace names free of sensitive detail, and for the patching and response decisions you make based on what ThreatLoops shows you.

ThreatLoops is an awareness tool. It does not detect attacks against you, and it is not a substitute for endpoint protection, backups, logging or an incident response plan.

If we become aware of a breach affecting your data we will notify affected accounts by email without undue delay, with what we know and what we are doing about it. Security contact: support@threatloops.com.

If you have found a vulnerability, email the same address with steps to reproduce. Please give us a reasonable window to fix it before disclosing publicly. We will not pursue legal action against good-faith research that avoids privacy violations, data destruction and service disruption. We do not currently run a paid bounty.

ThreatLoops is an independent product and does not hold SOC 2, ISO 27001 or any similar certification today. We would rather say that plainly than imply otherwise. The controls above describe what is actually in place; if your procurement process needs a questionnaire completed, email us.

We complete customer security questionnaires on request and can put a data processing agreement in place for business customers. Email support@threatloops.com and we will work through it before you buy, not after.