Security at Looptro

A retro holds the things a team says when it is being honest. This page says where that text lives, who can read it, and what we do not have yet.

Where your data lives

Looptro runs in the EU and nowhere else. The application runs on Fly.io in London. The database is Neon Postgres in eu-west-2. There is no US region and no replica outside the EU.

  • Application: Fly.io, London.
  • Database: Neon Postgres, eu-west-2.
  • Backups stay in the same region as the database.

Encryption

Traffic is encrypted in transit and data is encrypted at rest. Sessions live in HttpOnly cookies, so a script in the page cannot read them.

  • TLS 1.3 in transit.
  • AES-256 at rest, for the database and for backups.
  • Passwords are hashed with Argon2id. We never store a password.

Who can see a retro

Team data is isolated in the application code and again at the database query layer, so a missed check in a handler does not expose another team’s retro.

  • Per-team isolation enforced in code and at the query layer.
  • Optional single sign-on with Google, Microsoft, GitHub, or GitLab.
  • Anonymous retros mask the author on every post.

The audit log

Every action that changes state writes an append-only entry. Nothing in the product edits or deletes an entry.

  • Append-only. Entries are never rewritten.
  • An agent action logs alongside a human action and is marked as an agent action, so you can review what an AI agent did.
  • You can export the log.

Your data is yours

You can export a retro as Markdown or JSON, and you can delete your account from inside the app. Neither needs a support ticket.

  • Self-serve export in Markdown and JSON.
  • Self-serve account deletion.
  • A free anonymous retro deletes itself 24 hours after it is created.

What we do not have yet

If one of these is a requirement for your team, it is better that you know now.

  • SOC 2 Type II. The work is in progress. Looptro is not certified today, and no certification is held by us or claimed on our behalf.
  • ISO 27001. In progress, on the same footing.
  • SAML single sign-on and SCIM provisioning. Planned for the Maxx tier, not shipped.
  • Client-side end-to-end encryption. Planned. Today the server can read retro content, which is what makes search, export, and the API work.

Reporting a vulnerability

Email security@looptro.dev. We aim to acknowledge a report within two business days and to fix within 90 days, faster for a critical or actively exploited issue. The machine-readable version of this is at /.well-known/security.txt, per RFC 9116.

For what we collect and why, read the privacy policy. For the third parties that process data on our behalf, read the subprocessor list.

Questions about security

Is Looptro SOC 2 certified?

No. The work is in progress and Looptro holds no certification today. Where you see a SOC 2 or ISO 27001 badge on a tool in this category, check whether the certificate belongs to the vendor or to the cloud provider they host on, because the two are often presented as the same thing.

Where is retro data stored?

In the EU only. The application runs on Fly.io in London and the database is Neon Postgres in eu-west-2. There is no US region, and no replica outside the EU.

Can Looptro staff read my retros?

Technically yes, and we would rather say so than imply otherwise. Retro content is encrypted at rest but the server can read it, which is what makes export, search, and the API work. Client-side end-to-end encryption is planned and would change this. Access to production is limited and every state-changing action writes an append-only audit entry.

What happens to a retro I start without an account?

It is deleted 24 hours after it is created. The window runs from creation and nothing extends it, so a retro you open on Monday is gone by Tuesday whether or not the team is still using it.

How do I report a security problem?

Email security@looptro.dev. We aim to acknowledge within two business days and to fix within 90 days, faster for a critical or actively exploited issue. The same details are published at /.well-known/security.txt in the RFC 9116 format.