generated: '2026-08-13'
method: searched
source: >-
  https://www.loomly.com/security, https://www.loomly.com/dpa,
  https://www.loomly.com/privacy, https://www.loomly.com/vulnerability_reporting_policy
name: Loomly Conformance and Compliance
description: >-
  What Loomly publicly asserts about standards and regulatory conformance, and
  what it does not. Loomly ships no machine-readable API contract, so every
  API-technical row below is a measured absence rather than a derived claim.
standards:
  - id: oauth2
    conforms: true
    confidence: medium
    evidence: >-
      A routed OAuth 2.0 authorization-code endpoint responds at
      https://app.loomly.com/oauth/authorize (302 to sign-in), and Loomly's own
      help articles describe a Zapier authorize-and-consent flow. No RFC 6749
      conformance statement is published.
  - id: rfc8414
    name: OAuth 2.0 Authorization Server Metadata
    conforms: false
    evidence: >-
      /.well-known/oauth-authorization-server returns 404 on www.loomly.com and
      app.loomly.com.
  - id: oidc
    conforms: false
    evidence: /.well-known/openid-configuration returns 404 on all Loomly hosts.
  - id: openapi
    conforms: false
    evidence: >-
      No OpenAPI/Swagger document found at /openapi.json, /openapi.yaml,
      /swagger.json, /api-docs or /api/openapi.json on www.loomly.com,
      app.loomly.com, status.loomly.com or loomly.com (all 404), and
      api.loomly.com does not resolve.
  - id: asyncapi
    conforms: false
    evidence: No AsyncAPI document and no first-party webhook reference published.
  - id: rfc9457
    name: Problem Details for HTTP APIs
    conforms: false
    evidence: >-
      No error reference published; the status API returns plain JSON envelopes
      with no application/problem+json media type.
  - id: rfc9116
    name: security.txt
    conforms: false
    evidence: /.well-known/security.txt returns 404 on all Loomly hosts.
  - id: rfc8594
    name: Sunset HTTP Header
    conforms: false
    evidence: No deprecation or sunset policy published.
  - id: pagination
    conforms: true
    confidence: high
    evidence: >-
      The status API returns a meta object with count and total_count and a
      links.next href on collection endpoints (observed on
      https://status.loomly.com/api/v1/components).
  - id: idempotency
    conforms: false
    evidence: >-
      No Idempotency-Key header, retry-safety guidance or idempotency
      documentation is published for any Loomly surface.
regulatory:
  - id: gdpr
    conforms: partial
    evidence: >-
      Loomly publishes a Data Processing Agreement at https://www.loomly.com/dpa
      and a subprocessor list on its security page. The security page itself does
      not name GDPR.
  - id: pci-dss
    conforms: true
    scope: merchant
    evidence: >-
      Loomly states it is PCI-DSS compliant as a card-not-present merchant;
      cardholder data is handled by Stripe.
  - id: soc2
    conforms: false
    evidence: >-
      SOC 1/2/3, ISO 27001 and PCI DSS Level 1 are named on the security page as
      certifications held by Loomly's DATA CENTER PROVIDER (AWS), not by Loomly.
      No Loomly attestation is offered.
  - id: iso27001
    conforms: false
    evidence: Same as soc2 — inherited from AWS, not held by Loomly.
  - id: hipaa
    conforms: false
    evidence: Not mentioned on any public Loomly page.
security_program:
  penetration_testing: >-
    Third-party penetration tests are conducted against the application and
    supporting infrastructure at least annually (Loomly security page).
  encryption: TLS/HTTPS in transit; AES at rest, managed by AWS.
  mfa: Two-factor authentication available on all plans; enforceable per calendar on Beyond.
  vulnerability_disclosure: https://www.loomly.com/vulnerability_reporting_policy
evidence:
  - url: https://www.loomly.com/security
    http_status: 200
  - url: https://www.loomly.com/dpa
    http_status: 200
  - url: https://www.loomly.com/vulnerability_reporting_policy
    http_status: 200
  - url: https://www.loomly.com/.well-known/openid-configuration
    http_status: 404
  - url: https://www.loomly.com/openapi.json
    http_status: 404