ISO 27001:2022
Information security management, with processes to identify risks and establish protective controls.
View the ISO 27001 certificateSECURITY AND COMPLIANCE
Security and privacy for legal work
Explore the security controls, data protection practices, and commitments that guide the Looplex platform. Review certifications and documents to assess the use of our solutions in your organization.
Visit the Compliance CenterRequest security informationEVIDENCE YOU CAN REVIEW
Looplex certifications
Looplex holds certifications for information security and privacy.
ISO/IEC 27018:2021
Controls for protecting personal data in public cloud services.
View the ISO 27018 certificateISO/IEC 27701:2019
Privacy information management, with requirements for personal data processing.
View the ISO 27701 certificateDATA PROTECTION
How we protect your data
We combine technical controls, policies, and processes to protect information and support service continuity. Applicable measures take the product, architecture, risks, and agreement into account.
01
Identity and access
We restrict administrative access to authorized individuals, with permissions tied to their responsibilities. We apply the principles of least privilege and need-to-know access.
02
Data protection and segregation
We protect data with encryption in transit and at rest. Logical controls separate organizations, environments, and permissions.
03
Secure development
We maintain secure development practices, code review or equivalent controls, testing, and change management. Vulnerabilities are addressed according to severity and risk.
04
Monitoring and vulnerabilities
We use logging and monitoring appropriate to each service. Assessments, scans, and tests help identify vulnerabilities and guide remediation.
05
Incident response
We maintain processes to identify, investigate, and respond to security incidents. Customer communications follow the conditions applicable to the event and the affected data.
06
Continuity and recovery
We implement continuity and recovery measures appropriate to the service. Availability and support commitments are defined for the services and features covered by the SLA and the agreement.
Learn more in How we protect your data, the Corporate Security Measures Notice and the Looplex Platform SLA.
ARTIFICIAL INTELLIGENCE
Transparency about how AI uses data
Using artificial intelligence involves decisions about context, providers, permissions, and information processing. Our documents explain these conditions to support the assessment of each solution.
Data use for training and improvement
Identifiable, non-public customer content is never used to train products for other customers, except with specific authorization, as part of a custom project, or on another applicable contractual and legal basis. See our DPA and Privacy Notice.
Providers and processing
We seek to use commercial or enterprise accounts and settings designed to prevent providers from using customer inputs and outputs for general training, subject to applicable authorizations, specific opt-ins, or instructions.
Retention, abuse review, and zero-retention options vary by provider, service, and agreement. See the Subprocessor List.
Agent permissions and actions
Agent permissions, tools, integrations, and logs are controlled according to the product. Models, tools, or actions may be restricted for security and compliance reasons. These controls are described in the Corporate Security Measures Notice.
Reviewing results
AI outputs may contain errors. Professional review is part of responsible use, especially before using outputs or actions with legal, financial, or external effects. See the guidance in the AI Transparency Notice.
INFORMATION MANAGEMENT
Where your data is processed and how it is managed
Locations and providers
Brazil and the United States are the primary planned locations for production processing. Actual locations and other access or processing depend on the product, provider, and configuration. The Subprocessor List sets out the relevant services, purposes, and locations.
Retention, export, and deletion
Retention periods vary by product and data category. Export and deletion follow the features and terms of your agreement. Backups have their own cycles, and certain information may be retained to meet legal obligations, ensure security, or establish or defend legal rights. See the rules in the DPA.
Privacy and responsibilities
The documents distinguish processing on the customer's behalf from activities where we determine our own purposes, such as account management, support, and security. The Privacy Notice explains these activities and the channels for exercising your rights.
COMPLIANCE CENTER
Documentation for your assessment
Find documents to support your review of security, privacy, and procurement requirements for Looplex solutions.
ISO 27001 certificateInformation security management certification.CertificationsPDF — opens in a new tabISO 27018 certificateCertification for the protection of personal data in the public cloud.CertificationsPDF — opens in a new tabISO 27701 certificatePrivacy information management certification.CertificationsPDF — opens in a new tabHow we protect your dataSecurity commitments for enterprise services.SecurityDOCS — opens in a new tabCorporate Security Measures NoticeTechnical and organizational controls and the conditions for their application.SecurityDOCS — opens in a new tabPrivacy NoticeProcessing purposes, sharing, retention, and rights.Privacy and AIDOCS — opens in a new tabData Processing Agreement — DPAResponsibilities for personal data processing, including provisions on AI.Privacy and AIDOCS — opens in a new tabSubprocessor ListProviders, purposes, locations, and processing conditions.Privacy and AIDOCS — opens in a new tabLooplex Platform SLACoverage, service targets, and support and availability terms.AvailabilityDOCS — opens in a new tab
No documents found
Try another search term or select a different category.
INFRASTRUCTURE
Infrastructure and integrated services
Assessing a solution also involves the infrastructure services and components integrated into the offering. Each provider's certifications must be assessed within their own scope.
Responsibilities for infrastructure and application controls follow the shared responsibility model, according to the service used. Learn more in Microsoft's documentation on cloud responsibilities.
To assess a specific agreement, identify the product, the supplying company, and the services involved.
Request assessment informationFREQUENTLY ASKED QUESTIONS
Answers for your team
Who can access my data?
Administrative access to production systems is restricted to authorized personnel, according to their responsibilities and need for access. Service providers must have access limited to what is necessary to carry out their activities. See How we protect your data.
Is my data used to train AI?
The rules distinguish identifiable private content from public information, technical data, and anonymized data. They also distinguish use by Looplex from processing by providers. See the AI section on this page and the terms of the DPA.
Does data stay exclusively in Brazil?
Processing may take place in Brazil, the United States, and other locations specified for the services used. Check the configuration applicable to your agreement and the Subprocessor List.
Can I export my data or request its deletion?
These options depend on the product, available features, and agreed terms. Deletion from the active environment and deletion from backups follow separate procedures, subject to the retention exceptions set out in the DPA.
How can I request additional documents?
Select “Request security information” and specify your product and your organization's requirements. Additional materials are provided subject to availability, relevance, and confidentiality conditions. See the commitments in How we protect your data.
TALK TO LOOPLEX
Need a more detailed assessment?
Does your team need clarification on security requirements, documents to review, or help with a vendor assessment questionnaire?
Tell us which solutions you are interested in and what needs to be assessed so we can help.
Request security informationFor privacy and data protection questions, contact us at dpo@looplex.com.br, as listed in the Subprocessor List.