Data Security Policy

1. Security Commitment

SeenLoop LLC is committed to maintaining the highest standards of data security to protect client information, business data, and intellectual property. Security is not an afterthought — it is built into every layer of our systems and processes.

This Data Security Policy describes the technical and organizational measures SeenLoop employs to protect the confidentiality, integrity, and availability of all data we process.

2. Encryption Standards

SeenLoop applies strong encryption throughout our systems:

• In Transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2/1.3 with 256-bit encryption. We enforce HTTPS across all domains.
• At Rest: Sensitive data stored in our databases is encrypted using AES-256 encryption.
• Passwords: User passwords are hashed using bcrypt with a high work factor. We never store plain-text passwords.
• API Keys & Tokens: API credentials and sensitive tokens are encrypted and stored in dedicated secure vaults, never in plain text.
• Backups: All database backups are encrypted before storage and stored in geographically separated secure locations.

3. Access Controls

Access to client data is strictly controlled and limited:

• Principle of Least Privilege: Staff have access only to the specific data needed for their role, nothing more.
• Role-Based Access Control (RBAC): System roles are clearly defined with granular permissions.
• Multi-Factor Authentication (MFA): Required for all internal staff accessing production systems.
• Client Data Segregation: Each client's data is logically separated to prevent cross-client data access.
• Access Logging: All administrative access to production systems is logged and reviewed regularly.
• Regular Access Reviews: Access privileges are audited quarterly. Departing staff access is revoked immediately.

4. Infrastructure Security

Our hosting and network infrastructure includes enterprise-grade security controls:

• Cloud Hosting: Services are hosted on major U.S.-based cloud providers with SOC 2 Type II and ISO 27001 certifications.
• Firewalls: All servers are protected by multi-layer firewalls with strict inbound/outbound rules.
• DDoS Protection: Cloudflare Enterprise-level DDoS mitigation protects all public-facing services.
• Intrusion Detection: Automated IDS/IPS systems monitor network traffic for anomalies 24/7.
• Regular Patching: Server OS and application dependencies are patched monthly or immediately for critical CVEs.
• Network Segmentation: Production, staging, and development environments are completely separated.
• VPN: All internal access to production infrastructure requires VPN with MFA.

5. Data Handling & Retention

SeenLoop follows strict data minimization and retention principles:

• Data Minimization: We collect only the data necessary to provide our services.
• Retention Periods: Client data is retained for the duration of the service agreement plus 90 days after account closure for recovery purposes.
• Secure Deletion: Upon account closure (beyond the 90-day grace period), client data is securely deleted using industry-standard data destruction methods.
• Backups: Automated daily backups with 30-day retention. Weekly backups with 6-month retention.
• Data Processing Agreements: Available for enterprise clients requiring formal DPA documentation.

6. Payment Security

SeenLoop takes payment security with the utmost seriousness:

• PCI DSS Compliance: All payment processing is handled exclusively by Stripe, a PCI DSS Level 1 certified processor. SeenLoop does not process, store, or transmit cardholder data directly.
• Tokenization: Stripe tokenizes payment methods so that only a non-sensitive token is stored on our side, never actual card numbers.
• Fraud Detection: Stripe Radar and 3D Secure authentication are enabled to detect and prevent fraudulent transactions.
• Secure Checkout: All payment pages are served over HTTPS with EV SSL certificates.

7. Incident Response

SeenLoop maintains a documented incident response plan (IRP) for handling security events:

• Detection: Automated alerts trigger immediately upon detection of anomalous activity.
• Containment: Security incidents are contained within 4 hours of detection in critical cases.
• Notification: Affected clients are notified within 72 hours of a confirmed data breach, per applicable law.
• Investigation: Root cause analysis is conducted for all significant incidents.
• Remediation: Security patches and improvements are deployed following each incident.
• Post-Incident Review: Lessons learned are documented and incorporated into security improvements.

To report a suspected security incident, please email security@seenloop.com immediately.

8. Employee & Contractor Security

Human factors are a critical element of our security program:

• Background Checks: All employees and contractors with data access undergo background screening.
• Security Training: Mandatory annual security awareness training for all staff.
• NDAs: All staff sign confidentiality agreements before receiving access to any client data.
• Acceptable Use Policy: Staff are bound by internal AUPs governing use of company systems and data.
• Offboarding: Access credentials are revoked within 24 hours of staff departure.

9. Compliance

SeenLoop maintains compliance with applicable security standards and regulations:

• U.S. Data Privacy Laws: Compliant with applicable state privacy laws including the California Consumer Privacy Act (CCPA) where applicable.
• FTC Regulations: Our data practices comply with FTC guidelines on consumer data protection and privacy.
• Stripe PCI DSS: Payment processing via Stripe ensures PCI DSS Level 1 compliance for cardholder data.
• OWASP Standards: Application development follows OWASP Top 10 security guidelines.
• HTTPS/TLS: All web properties enforce TLS 1.2+ in compliance with NIST recommendations.

10. Security Contact

For security-related matters, vulnerabilities, or to report an incident:

• Security Team Email: security@seenloop.com
• General Contact: info@seenloop.com
• Phone: +1 (505) 528-6570
• Responsible Disclosure: We encourage responsible disclosure of security vulnerabilities. Please report to security@seenloop.com before public disclosure.