Skip to main content

Security & Compliance Overview

Information security is a reason for concern for all organizations, including those that outsource key business operation to third-party vendors (e.g., SaaS, cloud-computing providers). Rightfully so, since mishandled data—especially by application and network security providers—can leave companies vulnerable to attacks, such as data theft, extortion and malware installation.

Our platform provides omnichannel messaging infrastructure for businesses, developers, and AI-powered applications. We continuously work to improve our security practices, infrastructure reliability, and data protection controls.

At Loop Message we consider security very seriously, everything has been detailed over this article.

SOC 2 and Trust Services Criteria

SOC 2 is an auditing framework developed by the American Institute of Certified Public Accountants (AICPA). It evaluates an organization’s controls against applicable Trust Services Criteria, covering five categories: Security, Availability, Processing Integrity, Confidentiality, and Privacy.

LoopMessage aligns its security and operational practices with these principles as part of our ongoing compliance initiatives.

Please note that Loop Message hasn’t been over any SOC2 audit but we wish to show we are fully compliant with these specific needs. This overview describes our security approach and product capabilities.

SOC2 Certification

SOC 2 certification is issued by outside auditors. They assess the extent to which a vendor complies with one or more of the five trust principles based on the systems and processes in place but as mentioned, we didn’t went through this process, this is an article that shows that we are compliant with SOC2.

1. Security

Security focuses on protecting systems and information against unauthorized access, disclosure, and misuse.

At LoopMessage, we implement security measures designed to protect customer accounts, messaging infrastructure, and API integrations.

These include:

  • Two-Factor Authentication (2FA) for additional account protection.
  • API key authentication for accessing messaging services.
  • Organization-specific API keys to separate customer environments and integrations.
  • Access controls designed to restrict unauthorized access to infrastructure and customer information.
  • Infrastructure monitoring and security practices designed to identify and address potential threats.

We continuously review and improve our security controls as our platform and infrastructure evolve.

2. Availability

Availability focuses on ensuring that systems and services remain accessible and operational in accordance with applicable service commitments.

LoopMessage operates messaging infrastructure designed to support reliable communications across multiple messaging channels.

We use operational monitoring and incident-management processes to identify service disruptions and support timely investigation and recovery.

Customers can review service availability and incident updates on our public status page.

We don’t provide any SLA’s or any contract but we are proud to say that we run an availability that is higher than 99% since 2022.

US Carrier Connectivity

For SMS and RCS services in the United States, LoopMessage operates as an official Mobile Virtual Network Operator (MVNO), working directly with major US wireless carriers, including AT&T and Verizon.

These direct carrier relationships form part of our US telecommunications infrastructure, supporting our ability to provide messaging connectivity and services to business customers.

Message delivery and availability remain subject to carrier policies, network conditions, device capabilities, and other factors outside LoopMessage’s direct control.

While we aim to maintain high availability, specific uptime guarantees apply only where expressly provided under a separate written agreement.

3. Processing integrity

Processing Integrity focuses on ensuring that system operations are complete, valid, accurate, timely, and authorized.

LoopMessage provides messaging APIs designed to support consistent and traceable message processing.

Our platform includes capabilities such as:

  • API authentication and request validation.
  • Message identifiers for tracking individual requests.
  • Delivery status tracking and webhook notifications.
  • Error responses to help identify failed or unsuccessful operations.
  • Deferred Messages to queue eligible requests according to applicable sending intervals.

These capabilities help customers monitor message processing, identify issues, and maintain control over their messaging workflows.

Actual message delivery also depends on destination messaging platforms and telecommunications providers, which operate outside LoopMessage’s direct control.

4. Confidentiality

Confidentiality focuses on protecting sensitive information from unauthorized access and disclosure.

LoopMessage applies access controls and data protection practices to help safeguard customer information throughout its lifecycle.

Customer organizations use separate API credentials and can configure their messaging resources independently.

Access to stored customer message history is not provided to technical support personnel by default. When troubleshooting requires access to such information, it is handled in response to a customer support request.

The encryption and security characteristics of message delivery depend on the selected messaging channel. Some channels support end-to-end encryption, while others, including traditional SMS, do not.

Customers handling sensitive information should evaluate the security characteristics and limitations of each messaging channel before use.

5. Privacy

Privacy focuses on the responsible collection, use, retention, disclosure, and disposal of personal information.

LoopMessage provides customers with tools to control how certain categories of messaging data are retained and where inbound attachments are stored.

Data Retention

Customers can configure separate retention periods for:

  • Message history.
  • Webhook history.
  • API request history.

The minimum configurable retention period is one day.

Learn more: Data Retention.

Customer-Controlled Attachment Storage

LoopMessage supports S3-compatible storage integrations, allowing customers to store inbound message attachments in storage infrastructure they manage.

Supported providers include Amazon S3, DigitalOcean Spaces, Cloudflare R2, and other S3-compatible services.

Customers can apply their own storage access and retention policies.

Learn more: S3 Bucket Integration.

These controls apply to the relevant information managed by LoopMessage. They do not automatically control data independently retained by destination messaging platforms, telecommunications carriers, recipients, or external systems.

Enterprise Data Processing Agreements (DPA)

LoopMessage supports Data Processing Agreements (DPAs) for enterprise customers with additional data protection, privacy, or contractual compliance requirements.

For larger customers and organizations with specific compliance obligations, we can review and enter into customized DPAs that establish appropriate contractual safeguards for the processing of personal data.

Depending on the agreed terms and applicable requirements, these agreements may address:

  • Data processing responsibilities and permitted purposes.
  • Confidentiality and security obligations.
  • Data retention and deletion requirements.
  • Subprocessor management and third-party service providers.
  • Security incident notification and cooperation.
  • Applicable privacy and data protection requirements.

DPAs are available upon request and subject to mutual agreement.

Please contact our team to discuss your organization’s contractual and data protection requirements.

HIPAA and Healthcare Use Cases

LoopMessage recognizes that healthcare organizations may have additional security, privacy, and regulatory requirements.

We can review healthcare messaging use cases and discuss appropriate security documentation, Business Associate Agreement (BAA) requests, and channel-specific requirements.

The suitability of a messaging workflow for protected health information depends on its technical configuration, the applicable messaging channels, contractual safeguards, and regulatory requirements.

Not all messaging channels provide the same security protections, and no individual feature or messaging channel should be assumed to make a workflow HIPAA compliant by default.

Organizations planning to process protected health information should contact our team before enabling production workflows.

Security Documentation and Questions

We understand that organizations may require additional security information before integrating with LoopMessage.

For enterprise customers, we can discuss:

  • Security and infrastructure documentation.
  • Data Processing Agreements (DPA).
  • Business Associate Agreements (BAA) for eligible healthcare use cases.
  • Data retention and storage configurations.
  • Current SOC 2 audit status and compliance initiatives.
  • Additional security and regulatory requirements.

For questions about our security practices, compliance initiatives, current audit status, or available documentation, please contact LoopMessage Support through the Dashboard or our official support channels.