Security and data flow
How Loop Reports handles report data, written for IT security, data protection and risk teams. Use it to answer a vendor security questionnaire.
Last updated: 19 October 2026 ·
In short
Data flow
- Report data and photos
- Audit trail and approvals
- Evidence fingerprints (SHA-256)
- PDF, Excel, Word and website are generated here
- Photo search words
- Event counts (no content)
- Support message you write
- Only on Publish: finished website
- Resend and ImprovMX: email delivery
- Pexels, Pixabay, Openverse: photos
- Google Fonts: typefaces
Never sent: figures, texts, uploaded PDFs, Word or Excel files, evidence files
What leaves the browser, and when
| Action | What is sent | Recipient | Kept |
|---|---|---|---|
| Opening the app | Nothing from your report. The browser downloads the app files. | loopreports.app (Netlify) | Short technical logs at Netlify |
| Typefaces | A normal web request for font files (IP address, browser type) | Google Fonts | Per provider |
| Searching photos or videos | The search words; for a chosen photo its ID | loopreports.app, which asks Pexels, Pixabay or Openverse | Not stored |
| Usage counter | Only an event name such as “app opened” and the day | loopreports.app | Daily totals; no cookie, no IP address, no content |
| Support request | What you write, your email if you give one and, only if you tick the box, technical details (browser, app version, report type, licence status, recent error messages) | loopreports.app | Up to 12 months after the request is closed |
| Publish online (optional) | The finished website files (the same as the downloadable ZIP) and the licence key, which is checked again | loopreports.app (Netlify storage) | 12 months, then 30 days' notice; deleted when you take it offline |
Questions security teams ask
Where is report data stored?
In the browser on the user's computer: the browser's local storage for the report and its built-in database (IndexedDB) for images. When the user saves a project file, it is an ordinary file on that computer or network drive and follows your document policy.
Is the data encrypted?
In transit, every connection to loopreports.app uses HTTPS (TLS). At rest, the data sits in the browser profile on the device and is protected by the device's disk encryption and the user's operating-system account. We recommend running the app on devices with full-disk encryption, as most corporate policies already require.
Can Loop Reports staff see or recover our data?
No. We never receive report data, so we cannot read, restore or disclose it. The only exceptions are what you publish online, which is public by design, and what you write to support.
Which third parties are involved?
Netlify (hosting, server functions, storage of published websites and support requests), Pexels, Pixabay and Openverse (photo and video search), Google Fonts (typefaces), Resend (support emails that contain only a request number and link) and ImprovMX (forwarding of email to hello@loopreports.co). None of them receives report content, except Netlify for websites you publish.
Where are servers located?
Report data does not reach a server, so it stays where the device is. Netlify and the other providers may process the limited data above outside Türkiye and the EU under their own safeguards.
How is access controlled?
There are no Loop Reports accounts to manage. Access to a report is access to the device and browser profile where it is kept, or to the project file. Inside the report, roles for preparer, reviewer and approver are recorded by name.
Is there an audit trail?
Yes. Each change is logged with name, time and source. Each figure can be checked by a second person, and the person who entered it cannot check it. Evidence files are fingerprinted with SHA-256 while the file itself stays local. Approvals are withdrawn automatically when a figure or text changes. The full trail can be exported to Excel for the auditor.
How are licences protected against tampering?
A licence confirmation is a token signed with ECDSA P-256 on our server and verified in the browser with the public key. The private key exists only in the server configuration.
How is data deleted?
The user deletes a report in My reports, starts a new report or clears the browser's site data. We hold no copy to delete. A published website is deleted when the user takes it offline.
Which security measures does the website use?
HTTPS only; headers that block content-type sniffing and framing by other sites, a strict referrer policy and a permissions policy that disables camera, microphone and location. Server functions limit request rates.
Do you hold ISO 27001 or SOC 2 certification?
Not at present. Because report content is not processed or stored on our servers, the data your assessment has to cover is limited to the items in the table above.
Who do we contact about a security issue?
Write to hello@loopreports.co. We answer security reports with priority.