Security
How Loopyah protects your data.
Organizers trust Loopyah with their events, revenue and customer data. Security is built into how we design, build and run the platform, and this page summarises the measures we take to protect that information.
Last reviewed 6 November 2026
Data encryption
All data is encrypted in transit using TLS 1.2 or higher, and browsers are instructed to connect only over HTTPS. Data is encrypted at rest using AES-256, including our databases, file storage and backups. Credentials for connected services, such as ad accounts, are encrypted before they are stored.
Infrastructure and backups
Loopyah runs on leading cloud providers, with primary data hosted in Australia. Our databases sit on private networks with no direct access from the internet. Data is backed up automatically, and a standby copy runs in a separate data centre.
Network and application protection
All traffic reaches Loopyah through a global security network that filters malicious requests before they reach our servers, and our servers accept connections only through it. Other websites can't display Loopyah pages inside their own, except the event pages organizers choose to embed.
Payments
Payments are processed by Stripe, which is certified to PCI Service Provider Level 1, the highest level of certification in the payments industry. Card details are entered directly into Stripe's secure payment fields and never reach Loopyah's servers. Organizers manage payouts and bank details directly with Stripe.
Sign-in
Loopyah is passwordless. People sign in with a one-time code sent to their email, or with Google, Apple or Facebook. Codes expire quickly, and repeated incorrect attempts temporarily pause sign-in by code. Sessions are held in secure cookies that are sent only over encrypted connections and can't be read by page scripts.
Access control
Every team member is assigned a role with only the access it needs, and the server enforces those permissions on every request. Revenue and payout information is limited to owners, admins and finance. Internal staff tools are restricted to authorised Loopyah staff and protected with two-step verification.
Ticket integrity
Every ticket carries a unique code that is verified against our records at entry, and each ticket can be checked in only once.
AI assistants
Connecting Claude or ChatGPT requires your explicit approval. You choose read-only or read-and-write access, the assistant works within your existing team permissions, it can't move money, and you can revoke access at any time from Connectors in your settings.
Data retention and deletion
When you delete your account, we erase your personal details and revoke any connected AI assistants. Transaction records are kept without personal details for as long as tax and financial reporting laws require. Organizers keep the details from orders placed with them, and we keep limited sign-in security records to protect against account takeover. See our Privacy Policy for details.
Reporting a vulnerability
If you believe you've found a security vulnerability, please email security@loopyah.com with a description of the issue, the steps to reproduce it and its potential impact. We ask that you act in good faith: don't access or modify other people's data, disrupt the service, or disclose the issue publicly before we've resolved it.
Read our Privacy Policy and Terms.