Security is how we're built, not what we bolt on

SurfaceLoop is multi-tenant with strict data isolation enforced at the database level. Every table uses PostgreSQL Row-Level Security (RLS) policies so that queries can only return rows belonging to your organisation. There is no application-level filtering that could be bypassed — isolation is enforced by the database engine itself.

We use Clerk for identity management. Every authenticated API request is verified against a cryptographic public key — your identity is derived from a signed JWT, never from a request body or URL parameter. Sessions are short-lived, and all auth tokens are transmitted over TLS 1.2+.

All secrets — database credentials, third-party API keys, and signing keys — are stored in AWS Systems Manager Parameter Store using KMS-encrypted SecureString parameters. Secrets are injected into services at runtime and never baked into Docker images, source code, or environment files committed to version control.

All scan results, asset records, and customer data are stored in the AWS Europe (Ireland) region (eu-west-1), within the UK/EEA. We do not replicate your data to regions outside the UK/EEA. Our infrastructure runs on AWS ECS Fargate with non-root containers and strict IAM policies scoped to the minimum required permissions.

SurfaceLoop is designed for UK GDPR and ICO compliance from the ground up. We practise data minimisation — scanners collect only what is needed to identify exposures. Right-to-erasure is supported via cascade deletes across all related data. Raw scanner output is discarded after processing; only normalised exposure records are retained. All scan initiations are audit-logged with timestamps for accountability.

Every scan target is validated against your verified asset inventory before any scanning begins. We never accept a raw IP address or domain from an API request and scan it directly. Private and reserved IP ranges (RFC 1918, loopback, link-local) are blocked at the CIDR expansion layer. Rate limits and port allowlists are enforced per target to prevent abuse.

Every pull request runs through automated linting, type checking, unit tests, and a full build. On top of that, Snyk scans for vulnerable dependencies, SonarCloud analyses code quality, and Gitleaks checks for accidentally committed secrets. No code reaches production without passing all checks — force-pushing and hook bypasses are prohibited.

Dependencies are monitored by Dependabot for automatic update PRs. Every update goes through our full CI pipeline including Snyk vulnerability scanning. We pin exact versions of critical tools like Nuclei and validate new versions against our test suite before deploying. All outbound service connections from our scanner are explicitly allowlisted and reviewed.