Built with security in mind

TrustLoop uses modern security practices for sessions, passwords, payments, and the public-facing widget.

Owner passwords are hashed with PBKDF2 and a random salt. We never store plain text.

HTTP-only, secure, same-site cookies signed with a server-side secret.

Content Security Policy and other security headers are set in next.config.ts.

Supabase RLS policies keep users from reading or changing data that isn't theirs.

Every API route validates and sanitizes input with Zod before touching the database.

Auth and public testimonial endpoints are rate-limited to reduce abuse.

Open source

TrustLoop is open source. You can inspect the full code on GitHub, run your own scans, and verify that these claims match the implementation.