Skip to content

Trust centre

A security vendor that passes its own review

Two independent isolation layers, encryption everywhere, and the certifications your procurement team asks for — documented here so your questionnaire takes an afternoon instead of a fortnight.

SIGN INCollectorCharacters destroyednever written anywhereEvent recordedwho · campaign+41s after deliveryEnforced in code, not in policy.The person is coached immediately. The password isgone before any write happens — and third-partypenetration testing checks exactly that.

Architecture

Two enforcement layers, not one

Multi-tenancy is where SaaS platforms leak. SafeLoop scopes every query in the application and then makes the database refuse anything that slips through.

Isolation

A bug in the app is not a data breach

Organisation scope is bound to the execution context when a request is authenticated, and applied at the repository layer rather than passed around as an argument that a developer can forget. Postgres row-level security then enforces the same boundary independently.

  • Scope applied below the query builder, not in each handler
  • Row-level security policies on every tenant-owned table
  • Cross-tenant access by SafeLoop staff is audited and time-boxed
Request — Authenticated session, org resolved from the subdomainRequestAuthenticated session, org resolved from the subdomainTenant context — orgId bound to the async execution context — not a request argumentTenant contextorgId bound to the async execution context — not a request argumentRepository layer — Every query is scoped before it reaches the driverRepository layerEvery query is scoped before it reaches the driverPostgres row-level security — The database refuses cross-tenant reads even if the app is wrongPostgres row-level securityThe database refuses cross-tenant reads even if the app is wrongYour data — Encrypted at rest, keys in a managed vaultYour dataEncrypted at rest, keys in a managed vault
Two independent enforcement layers. A bug in one does not become a data breach.

How we protect your data

Security by design, in specifics

No vague assurances. These are the controls, and what each one actually prevents.

Encryption

Encrypted in transit and at rest

TLS 1.2+ on every connection, encrypted storage and snapshots, secrets held in a managed vault with rotation — never in code, config or logs.

  • TLS 1.2+ enforced
  • Envelope encryption at rest
  • No secrets in application logs
Credentials

We never store submitted passwords

When someone types a password into a simulated login page, the event is recorded and the person is coached. The characters are discarded at the collector before anything is written.

  • Event recorded, credential discarded
  • Enforced in code, not policy
  • Verified in penetration testing
Access

SSO, MFA and least privilege

SAML and OIDC single sign-on, enforced MFA for every admin role, and role-based access control checked on every action rather than every page.

  • Enforced admin MFA
  • RBAC per action
  • Session and device revocation
Provisioning

Access ends when employment does

SCIM and directory sync deprovision in the same cycle your IdP does, so a leaver cannot log in after their last day.

  • 15-minute sync interval
  • Immediate deprovision on IdP removal
  • Orphaned-account report
Transparency

Immutable audit log

Every administrative and security-relevant action is appended to a tamper-evident log, exportable for your auditors and streamable to your SIEM.

  • Append-only
  • Signed webhook stream
  • 13-month default retention
Residency

You choose the region

EU (Ireland), UK (London) or US (Virginia), selected per tenant at provisioning. Data does not cross the boundary for processing or backup.

  • Regional isolation
  • Region-local backups
  • Published subprocessor list per region

Trust & compliance

Audited, certified, and mapped

The frameworks SafeLoop is assessed against — and the ones your academy content is mapped to for your own audit.

SafeLoop is audited against

SOC 2Type II
ISO 27001Certified
ISO 27701Privacy
Cyber EssentialsPlus

Your training evidence is mapped to

  • NIST CSF 2.0PR.AT
  • HIPAA§164.308(a)(5)
  • PCI DSS v4.012.6.3
  • GDPRArt. 39
  • ISO 27001A.6.3
  • SOC 2CC2.2

Controls

Programme controls in detail

Control areaImplementationEvidence available
Penetration testingAnnual third-party test plus targeted tests on major releasesExecutive summary under NDA
Vulnerability managementContinuous dependency and image scanning; critical patched within 7 daysPolicy + remediation SLAs
Secure developmentMandatory review, CI security gates, no direct production accessSDLC policy
Business continuityMulti-AZ deployment, automated backups, documented restore testingBCP/DR summary + RTO/RPO
Incident response24/7 on-call, documented severity model, customer notification commitments in the DPAIR policy
PersonnelBackground checks where lawful, annual security training, least-privilege access reviewsHR security policy
SubprocessorsPublished list, assessed before onboarding, notified in advance of changesLive subprocessor register

Full policy documents and the SOC 2 Type II report are available under NDA through the trust centre.

Need something for your questionnaire?

Tell us which framework you assess against and we will send the mapped evidence pack — usually the same working day.

See your human risk in 20 minutes

Book a demo and we’ll run a sample campaign against a test group.