Security at SurfaceLoop

We build a security product - we hold ourselves to the standard we measure our customers against.

Is scanning safe for my systems?

Yes. SurfaceLoop scans purely from the outside — the same view any attacker already has of your business. There are no agents to install, no firewall changes, and no access to your internal network. Scans observe what your systems expose publicly; they don't attempt to break in or disrupt services.

Infrastructure

SurfaceLoop runs on isolated cloud infrastructure with encryption at rest and in transit. All scan data is processed in memory and stored encrypted.

Data handling

Scan results are tied to your account and never shared. We retain data only as long as your account is active. You can export or delete your data at any time.

Authentication

All accounts are protected by bcrypt-hashed passwords and optional two-factor authentication. Session tokens are short-lived and rotated automatically.

Responsible disclosure

If you discover a security issue in SurfaceLoop, please report it to security@surfaceloop.com. We commit to acknowledging reports within 48 hours.