Information Security at Looplex
Information security at Looplex covers an organization’s documents and data, access to the platform, its integrations, and work performed by people and artificial intelligence agents. Controls follow the information lifecycle, from intake through sharing, retention, and deletion.
Protection combines architecture, secure development, and ongoing operations. The platform applies common controls across its services and supports adjustments according to the product, deployment, and organization’s needs.
Security Operations
Security operations, or SecOps, integrate prevention, monitoring, and risk management into platform operations. The security team works with development, infrastructure, and product owners to assess changes, address vulnerabilities, and monitor services.
The functions of a security operations center, or SOC, include monitoring events, investigating signs of compromise, and coordinating initial containment measures. Incident response brings together a team with the necessary expertise, also known as a CSIRT. The team’s composition varies with the event, while responsibilities, escalation channels, and response procedures remain defined.
Standard Platform Controls
Looplex applies identity and authorization controls, logical separation between organizations, credential management, secure development, and logging of relevant events. Resource access takes into account the identity used, the organization, and the permissions assigned to the operation.
Communications use cryptographic protection. Controls over stored data, environments, and infrastructure follow the nature of the service and the deployment’s capabilities. Protection includes configuration management, dependency assessment, and vulnerability remediation based on severity and exposure.
Operations monitor availability indicators, failures, and security events. Records support investigations and the identification of abuse patterns, with restricted access and retention appropriate to their purpose.
AI work operates within the same control framework. Document access, tool use, and agent actions remain subject to the permissions and policies applicable to the execution.
Organization Settings
The organization defines the users, groups, roles, and document collections available for each activity. Depending on the product and deployment, it also configures identity integrations, authentication requirements, enabled tools, approvals, and sharing rules.
Specific conditions for data location, connectivity, additional retention, continuity, and recovery are defined in the contracted solution. Recovery objectives and availability follow the applicable product and SLA.
Customer Responsibilities
The customer is responsible for keeping users and permissions up to date, protecting credentials under its administration, and establishing access and sharing criteria appropriate to the sensitivity of the information.
The organization also administers its devices, source systems, and integrations within its scope of responsibility. It must designate approval owners, review work with legal, financial, or external effects, and report suspected misuse through Looplex’s support and privacy channels.
Providers operate according to the division of responsibilities for each service. Datacenter and infrastructure controls may be performed by the providers used, while Looplex administers the components within its operational scope.
Incident Response
The response process includes identification, triage, containment, investigation, communication, recovery, and lessons learned. The assessment considers the resources involved, the sensitivity of the information, and the potential impact on customers and services.
Depending on the incident, measures include restricting access, revoking credentials, suspending an integration or execution, isolating components, and preserving evidence. Recovery includes verification of security conditions and the measures needed to reduce the likelihood of recurrence.
Communication and handling of incidents involving personal data follow the DPA. Integrating response into ongoing risk management is consistent with the approach described in NIST’s incident response guidance.
Related Documentation
The scope of measures, retention periods, and contractual conditions are described in the Corporate Security Measures Notice and the Data Processing and Protection Addendum. Providers that may participate in processing are identified in the Subprocessors List.