How your data is held, and what we have not done yet.
Written for the person who has to sign off on sending us twelve months of commercial data. It covers what is in place today, what is deliberately out of scope, and, in its own section, what we have not yet done, because that is the part most security pages leave out.
Last updated: September 2026
The shape of the risk
MarginLoop reads commercial data: sales lines, purchase invoices, stock movements, supplier terms, and customer account identifiers with payment dates. That is genuinely sensitive: it describes your margins, your costs and your customers' behaviour, but it is a narrower category than most software of this kind handles.
It contains no bank credentials, no card data and no payroll, and it needs no write access to anything. Reducing what is in scope is the first and most effective control, and it is a design decision rather than a policy one.
MarginLoop is designed to minimise personal data. Names and contact details are not required for payment-behaviour analysis and should not be included in standard exports. Where an export incidentally contains some, it is processed as described under “Personal data is minimised by design” below.
Read-only, always
MarginLoop reads. It does not write back to your accounts, EPOS or stock systems, it does not place orders, it does not raise credit notes, and it does not contact your suppliers or your customers.
This is worth stating under a security heading rather than only a marketing one: the worst case for an integration that can write is materially different from the worst case for one that cannot. Ours cannot.
Where data is held
- UK-region infrastructure.
- Encrypted in transit and at rest.
- Separation between customers enforced at the database level for every tenant-owned record, rather than left to application code to remember to filter correctly.
- A Data Processing Agreement, naming every sub-processor, provided before any of your data is shared with us.
That last point is the one worth reading twice. Marketing language and legal architecture have to match exactly, or one of them is untrue. Your commercial data is isolated from other customers, never pooled, never used to benchmark you, and never shared with your suppliers or another MarginLoop customer. It is not true, and we do not claim, that nobody else ever processes it: our hosting provider, our named sub-processors and a controlled number of authorised personnel technically process it in order to run and support the service.
Access
In place today: access to customer data is limited to the personnel who need it to deliver or support the service, and every one of them is named in the Data Processing Agreement.
Designed, not yet built, and it matters that the difference is stated on a page like this one. Role separation within your own tenancy, so that an owner, a buyer, someone in accounts, a rep and a depot manager do not all see the same supplier costs, receivables, customer balances and rebate agreements. And an audit trail on business-rule changes, so that a cover target moving from three weeks to eight is recorded with who changed it and when.
Neither is available today. If either is a condition of your sign-off, say so on the call and we will give you a real timescale rather than a reassuring one.
Personal data is minimised by design
Payment behaviour is a property of an account, not of a person. MarginLoop measures days-to-pay against an account's own history using account identifiers and dates, and needs no names, addresses, phone numbers or email addresses to do it. They are not requested, not required, and should not be included in the export you send.
Where an export does incidentally contain personal data, a buyer's name on a purchase order for instance, we process it as a processor on your instructions, under the Data Processing Agreement. You remain the controller for your own commercial and customer data.
This website
Separately from the product: this site sets no cookies, runs no analytics, loads no third-party script, and self-hosts its fonts, so rendering this page sends your IP address to nobody but our hosting provider. The booking page links out to Calendly for slot selection rather than embedding it. There is a fuller account on the cookies page.
Deletion and exit
- You can ask for your data to be deleted at any time, and it is deleted.
- Customer data is retained while a subscription is active plus a limited wind-down period for export, then deleted. Specific periods are in the Data Processing Agreement.
Exporting your own rules, corrections and results, so you leave with the configuration you built rather than only the data you sent, is a commitment we intend to keep and have not yet built. It is written into the design rather than into the product, and it belongs in the paragraph above only once it is real.
What we have not done yet
This section exists because a security page without one is not a security page. As of September 2026:
- We hold no ISO 27001, SOC 2 or Cyber Essentials certification, and we do not describe ourselves as “GDPR compliant”, because that is a claim about an ongoing state, not a certificate anybody issues.
- There has been no independent penetration test or third-party security audit.
- There is no published status page or uptime commitment. The morning list is not yet operationally critical to anybody, and we will put that infrastructure in place before it is.
- There is no formal, externally audited incident response process. There is a named person who is responsible, and you will be told promptly if anything affects your data.
- Role-based access within a customer tenancy, an audit trail on business-rule changes, and self-service export of your rules and corrections are all designed but not built.
If your procurement process requires any of the above, tell us on the call and we will be straight with you about the timescale rather than implying we already have it. For an early engagement with a small number of businesses, the honest position is that the strongest controls we have are architectural: read-only access, a narrow data scope, no personal data, database-level tenant separation and UK hosting, and that the certifications follow the customers, not the other way round.
What has to be true before we sell to a larger business
An owner-led wholesaler where two or three people see everything is a different proposition from a distributor with separate finance, buying, sales and depot teams. The controls below are tolerable for the first and necessary for the second, and we would rather set that boundary ourselves than be found on the wrong side of it.
- Role-based access control within a customer tenancy, so that finance, buying, sales and a depot manager do not all see the same supplier costs, receivables and rebate agreements. Designed, not built. Necessary before selling into a business with those roles separated.
- An immutable audit trail on business-rule changes, so a cover target moving from three weeks to eight carries who changed it and when, and cannot be edited afterwards. Designed, not built. Necessary alongside role separation, because access control without an audit trail records nothing.
- Then, in this order: an independent penetration test, Cyber Essentials, and a documented incident-response and status-communication process.
- SOC 2 is not on this list. It becomes commercially relevant for US enterprise expansion and not before, and pursuing it early would cost money that buys nothing for a UK wholesaler.
Nothing on this list is claimed as in progress unless it is. If a specific item is a condition of your sign-off, say so on the call and we will give you a real timescale, or tell you we are not the right supplier yet.
Reporting something
If you believe you have found a vulnerability in this site or in the product, contact us using the details below. We will acknowledge it, we will not take legal action against anyone reporting a genuine issue in good faith, and we will tell you what we did about it.
Security questions
Email aghakhan@marginloop.co.uk, or call 07447 019910 for anything on this page, a Data Processing Agreement, or a security questionnaire. A person will answer, and we will not pretend to hold a certificate we do not have.
MarginLoop Ltd, registered in England and Wales. Company no. 17430365. Registered office: 66 Paul Street, London, EC2A 4NA, England, United Kingdom. ICO registration no. ZC236427.
This page describes practice as at September 2026 and is maintained by engineering. It is not a certification, not a warranty, and not legal advice. Where a specific control matters to your procurement process, ask. We would rather have that conversation before a pilot than after one.
SCOPE
What it reads, and what it never touches
READS
- Sales history, line by line
- Purchase invoices, landed costs and supplier terms
- Stock movements, counts and open purchase orders
- Customer account identifiers and payment dates
- Product, pack size and case size
NEVER TOUCHES
- Your bank accounts
- Payroll or staff records
- Anything it could write back to
- Your customers' names or contact details
- Your suppliers, which it never contacts
Customer account identifiers and payment history can be analysed without MarginLoop needing anybody's name, address, phone number or email. Payment behaviour is a property of an account, not of a person.
What the first two weeks look like
DAY 1
History received and validated. We tell you what arrived, what is missing, and whether it is enough to work with.
DAYS 2–5
Products, suppliers and accounts matched; cover targets agreed with you; the calculations checked against figures you can verify.
WITHIN ONE WEEK
Your first morning list, built from your own twelve months.
WEEKS 2–3
Your corrections refine it. You tell us which lines were useful and which were noise, and those answers are remembered.
The export takes an afternoon. In the first week we will ask a few questions about product matches and cover levels, and that part needs somebody who knows the business. After that it runs, and nobody changes how they order, invoice or count.
LIMITS
What we do not claim
It will not run your buying for you.
It does not know that you keep a line for strategic reasons, or that a supplier relationship matters beyond the invoice price. You decide; it does the arithmetic and shows its working.
It is not artificial intelligence magic.
Careful arithmetic on your own history, run every night, with every assumption named. Where something is genuinely an inference, such as matching two product codes or reading a rebate agreement, it says so and gives you a confidence rather than presenting a guess as a fact.
It will not fix a broken stock file.
If what is on the system and what is on the shelf disagree, it will show you where, but somebody still has to walk the aisle and count.
FAQ
Two more about your data
Sales lines with date, account, product and value. Purchase lines with date, supplier, product, quantity and cost. A stock snapshot or stock movements. Customer account identifiers and payment dates: identifiers, not names or contact details. And supplier agreements or terms, if you want the rebate analysis, which is usually where the clearest money is. Ideally twelve months, because that is what makes seasonal comparison meaningful, but less can still be useful and we will say honestly what can and cannot be done with what you have.