Trust center
How Infoloop handles your code, your data and vendor risk
The security and ownership questions procurement teams ask before signing, answered in one place. Where the answer is no, this page says so.
Ask a security questionYour code. Your accounts. Your call.
Ownership, in your name from day one
The biggest risk in outsourcing software development is vendor lock-in. These four terms keep ownership and control with your company.
The code is yours
Source code lives in your repository and belongs to your company under the signed agreement. No buy-back fee applies when the contract ends.
The accounts are yours
Hosting, domain, platform and third-party subscriptions are registered in your name and billed to your company. Infoloop holds user access only, never ownership.
The data is yours
Business records remain in your accounts. On request, we export them in a standard format and confirm deletion of any copies we held.
You can leave
The notice period is defined in the support agreement. You receive the system documentation and a handover session, whether you move to another vendor or bring support in-house.
Day-to-day security practices
Practices, not promises. Ask us to demonstrate any of them during the call.
Access is limited and reviewed
Team members receive only the access their role requires, and lose it when the role changes. Access is reviewed whenever someone joins or leaves a project.
Traffic is encrypted
This website and the applications we deliver use encrypted connections. Credentials and API keys stay in the hosting platform's secret storage, never in source code.
Changes are reviewed
A second team member reviews every change before release. Each change is logged, so an audit trail shows who changed what and when.
Incidents have agreed response times
Response times are defined in your support agreement. The monthly report lists each incident and the resolution applied.
AI runs within defined limits
Every AI feature we deploy operates within defined permissions and logs each request and response. A person approves high-risk actions, and a switch can disable the feature.
NDAs as standard
We sign your non-disclosure agreement (NDA) before project details are discussed, as standard practice.
What we do not claim
Every vendor security page should include this section. Ours is short and accurate.
Infoloop does not hold SOC 2, ISO 27001 or an equivalent certification today. If your procurement process requires one, raise it on the first call to save both teams a month of review.
Infoloop is not a hosting provider. Your software runs on platforms such as Netlify, Shopify or your chosen cloud, under their security controls as well as our practices.
We publish only figures we have measured. Our published uptime covers software we support after launch, and we will share the monitoring report behind it.
Found a security issue?
If you find a vulnerability in this website or in software we support, please report it. A named person replies within one business day and later confirms the remediation steps taken.
Report it by emailhi@infoloop.co
Please include
- A plain-language description of the issue
- The steps to reproduce it
- Where it occurs: the URL or the screen
- Your contact details for our response
Have a security questionnaire?
Send it to us. Our own team completes it, rather than routing it through a form service, and we state clearly which items we cannot confirm.