QualifyLoop
Security and data handling
What QualifyLoop does with your data, where it lives, and what we don't have yet. If you're running a vendor review, start here.
Quick answer
QualifyLoop runs on Google Cloud in the US with data in Neon Postgres. Visitor data is purged after 24 months by default and can be deleted on request. QualifyLoop doesn't have SOC 2 or ISO 27001 certification, SSO or EU data residency. If those are requirements, it isn't the right choice yet. Questions: hello@qualifyloop.com.
Hosting
- API and AI agent: Google Cloud Run and Vertex AI, us-central1.
- Database: Neon Postgres, AWS us-east-2.
- Widget, settings and website: Cloudflare Pages.
Access controls
- Sign-in through Firebase Authentication, or server-to-server API keys stored as bcrypt hashes.
- Admin, Rep and Read-only roles, with key rotation and immediate revocation.
- Workspace isolation enforced in the application layer and tested with live cross-tenant requests.
- Application credentials held in Google Secret Manager.
- CRM and calendar access over OAuth; revoke it from the provider at any time.
Application protections
- HTTPS for traffic, security headers, and a CORS origin allowlist in production.
- Rate limiting of 60 requests a minute per IP on public routes.
- Signature verification on inbound billing and CRM webhooks.
Visitor privacy controls
- Consent gate. Company lookup and enrichment run only when your site passes a consent signal to the widget. You connect that signal to your own consent banner.
- Deletion. Admin and visitor erasure endpoints remove the visitor, sessions, conversations, messages, bookings, follow-up steps and buyer-group contact. Your site needs to expose the visitor request; the widget doesn't add a button.
- CRM copies. Records already pushed to HubSpot or Salesforce must be deleted in the CRM.
- Retention. A nightly job deletes visitors untouched for 24 months. The period isn't configurable per workspace yet.
See Is website visitor identification legal? for how consent and legitimate interests apply. This isn't legal advice.
Subprocessors
| Vendor | Purpose | Data involved |
|---|---|---|
| Google Cloud | Hosting, AI model, authentication, secrets | All application data; chat messages sent to Gemini |
| Neon | Database | All application data |
| Cloudflare | Static hosting and DNS | Request metadata |
| Team Cymru | Free IP-to-network lookup | Visitor IP address, via DNS query |
| Resend | Follow-up email | Visitor email and message content |
| Dodo Payments | Billing | Customer billing details |
Only if you connect them: HubSpot, Salesforce, Google Calendar, Slack, Twilio and a paid reverse-IP provider.
What we don't have yet
- SOC 2 or ISO 27001 certification, or a third-party penetration test report.
- SSO or SAML.
- EU data residency.
- A public status page.
Report a vulnerability
Email hello@qualifyloop.com with steps to reproduce.
Frequently asked questions
Is QualifyLoop SOC 2 compliant?
No. QualifyLoop doesn't hold SOC 2 or ISO 27001 certification.
Where is QualifyLoop data stored?
In the United States: Neon Postgres in AWS us-east-2, with the API and AI model on Google Cloud in us-central1. EU data residency isn't available.
How long does QualifyLoop keep visitor data?
Visitors untouched for 24 months are deleted by a nightly job. Individual records can be deleted earlier on request.