Security, in plain terms.
Every item on this page is something the product does today. No certifications we don't hold, and questions go to a person: security@loonext.com.
Encrypted in transit and at rest
Traffic to Loonext runs over HTTPS/TLS, and your data, the messages, contacts, and attachments, is encrypted at rest by our infrastructure providers. Message attachments live in a private, per-business storage bucket and are served only through short-lived signed links.
Message content stays out of analytics and error logs
We keep message content, names, addresses, and phone numbers out of our error monitoring (Sentry) and product analytics (PostHog). Error reports strip request and response bodies and redact phone-number patterns; analytics record events, counts, and IDs only, never message text.
Your data is stored in the United States
Loonext processes and stores data in the United States: our database, authentication, and file storage run on Supabase in the AWS us-east-1 region. How we handle personal information is in our privacy policy.
Sub-processors listed publicly
Every vendor that processes data on our behalf, what it touches, and the region it operates in is on our sub-processors page. When a vendor changes, that page and its date change with it.
30-day data handling on cancellation, as documented
Cancel and your number is held for 30 days, then released. Account and message data is kept afterward only as long as legal, tax, and carrier record-keeping duties require, then deleted or anonymized, exactly as documented in our terms and privacy policy. What is erased, what survives and why, and what closing a workspace does not reach are set out in full on deletion and what we keep.
The mechanics behind those claims.
Every business is an isolated tenant
Each database query is scoped to one business by its ID, and that scoping is where the isolation lives: the API authorizes every request itself. Postgres row-level security is enabled deny-by-default on every table underneath it, which stops anything reaching the database outside the API, though it does not second-guess the API's own queries. One business never sees another's conversations, contacts, or numbers. Realtime updates are gated the same way: you only join your own company's channel.
Signed webhooks, verified on arrival
Texts and payments reach us through webhooks, and we verify every one cryptographically before acting on it: Ed25519 signatures on carrier events, HMAC signatures on payment events. Anything that doesn't check out is rejected. A signature is the webhook's only way in.
Least-privilege keys and secrets
Server credentials are stored as encrypted secrets, never in the code or the repo. Payment access uses a restricted key limited to what billing needs; database access uses an independently revocable key. The browser only ever receives the minimal public configuration it needs.
Abuse defenses built in
Outbound texting is restricted to US and Canadian destinations, rate-limited per business, and bounded by a spending cap you control, layered defenses against SMS pumping and runaway bills. Opt-outs are enforced automatically at send time.
If there is ever a breach
We will tell you. If a breach of security safeguards creates a real risk of significant harm, PIPEDA and Law 25 require us to notify the affected people and the regulators as soon as feasible, and we treat that as a floor rather than a target: our commitment is to notify affected workspaces within 72 hours of confirming a breach, with what we know at that point rather than waiting for a complete picture. Where we are a processor for your data, we notify you and you notify your own customers. The timeline above is when you hear from us.
What we do not have
No SOC 2, no ISO 27001, and no third-party penetration test. Saying so is the point: those take a company larger than this one, and a page that implied otherwise would be the least trustworthy thing on it. What stands in their place is everything above, specific and checkable and true today, plus a public sub-processor list and a repository anybody can read. If a certification is a hard requirement for you, we are not there yet, and we would rather you learn that here than three weeks into a procurement.
Certifications: we hold none
No SOC 2, no ISO 27001, and none in progress. A Type II report is an observation window plus an auditor, and buying one now would describe controls around a product that still changes weekly. We would rather spend that on the things above, which are true today and which you can check.
If your procurement needs one, tell us. That is the signal we watch for, and it is a better one than a date we picked ourselves.
Responsible disclosure
Found a vulnerability? We want to hear from you. Email security@loonext.com with the details and steps to reproduce. Please give us a reasonable chance to fix the issue before disclosing it publicly, and don't access or modify data that isn't yours while testing. We acknowledge every report within two business days and tell you what we intend to do about it; you will hear from a person, not a form. There is no bounty. Saying so up front is fairer than letting you find out after the work.