Security
Security at CatchLoop.
Last updated: 24 October 2026
This page describes where CatchLoop runs, who can reach it, how your data is stored and encrypted, and who else is involved in processing it. If something you need is not answered here, ask and we will answer directly.
Compliance
CatchLoop is built for the GDPR. Our Data Processing Agreement covers the data your end users leave on your board, where you are the controller and we are the processor. The privacy policy covers your own account data.
We hold no SOC 2 report and no ISO 27001 certificate. CatchLoop is a young product run by a small team, and claiming an audit we have not been through would be the first thing on this page you could not verify. If your procurement process requires one, tell us and we will tell you honestly where we are.
Team
Production is reachable only by CatchLoop's maintainers, over key-based SSH. There are no shared passwords and no password login on the servers. Access to your workspace's contents is limited to what is needed to resolve a problem you have reported.
Hosting
The application, the database and the static assets run on OVHcloud infrastructure in France. That covers everything your customers write: requests, votes, comments and the accounts behind them.
Every subprocessor, the host included:
- OVHcloud (OVH SAS, France): hosting of the application and its database, and of our mailboxes (support, hello, privacy).
- Resend (Plus Five Five, Inc., USA): transactional email (sign-in links, changelog notifications). Mail is sent from Resend's EU region, but recipient addresses and delivery logs are processed in the US, under the EU-US Data Privacy Framework and standard contractual clauses.
Resend is a US company, so your data does not stay inside the EU end to end, and we would rather say so than let one French host imply a shorter list than the real one.
Data
Your workspace lives in a PostgreSQL database on that same host, in a volume dedicated to CatchLoop. Every query touching customer accounts, requests, votes and comments is scoped by workspace in one place that every request passes through, rather than repeated across handlers where a single omission would leak. A customer account belongs to one workspace and is never linked to another.
Data-subject rights are part of the product, not a support request. From the dashboard you can export your workspace as JSON and delete a customer account for good, with its votes and comments. Every vote belongs to a customer account.
Encryption
The website, the portal and the API are reachable over HTTPS only, TLS 1.2 and above, with certificates issued and renewed automatically.
There are no passwords to leak: signing in is a one-time link sent to the address, for your team and for your customers alike. Only a hash of each link is stored, it works once, and it expires after an hour. Sessions live in httpOnly cookies, and the MCP server takes your workspace key and never a session cookie.
Reporting a problem
If you have a question this page does not answer, or you believe you have found a vulnerability, email privacy@catchloop.co with enough detail to reproduce it. We will confirm receipt, keep you posted while it is being fixed, and credit you if you want to be credited.
