Is lofty.ai safe to use as a vendor?

lofty.ai scored 83/100 on LynxRadar's security posture assessment. The domain meets baseline security requirements. 8 checks passed, 1 warnings, 1 critical issues across 10 passive checks including TLS, DMARC, security headers, breaches, and CVEs.

What TLS version does lofty.ai use?

lofty.ai uses TLSv1.3 with TLS_AES_256_GCM_SHA384. TLSv1.3 negotiated with TLS_AES_256_GCM_SHA384 (256-bit). Strong configuration with no deprecated protocols or weak ciphers detected.

Does lofty.ai have SPF configured?

Yes. SPF record found: v=spf1 include:_spf.google.com include:spf.mandrillapp.com include:amazonses.com...

Does lofty.ai have security headers configured?

lofty.ai has 4 of 5 recommended security headers. Present: CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy. Missing: X-Content-Type-Options.

Has lofty.ai been involved in a data breach?

No known breaches found. No known breaches found in public disclosure databases.

Does lofty.ai have known CVE vulnerabilities?

Detected technologies: cloudflare. (cloudflare detected but excluded from CVE matching — upstream infrastructure). All detected technologies are upstream CDN/proxy infrastructure. No application-level software versions exposed.

Is lofty.ai's SSL certificate valid?

Yes. Strengths: Certificate valid, 87 days remaining; Issued by Google Trust Services. Note: Wildcard certificate in use (*.domain) — covers all subdomains. Common practice; worth noting that compromise would affect all subdomains.

Does lofty.ai have DNSSEC enabled?

Yes. Strengths: 2 nameservers configured (viddy.ns.cloudflare.com., dana.ns.cloudflare.com.); 5 MX records present; DNSSEC enabled; Zone transfers properly restricted.

lofty.ai Security Report — Grade B (83/100)

Q: Does lofty.ai have DMARC configured?

Yes. lofty.ai's DMARC policy is set to 'quarantine'. SPF record: yes. Strengths: DMARC policy set to quarantine; DMARC pct=100 — policy applies to all mail; DMARC sp=reject — subdomains fully protected; Aggregate reports (rua) configured; SPF soft-fail (~all) configured; SPF DNS lookup count: 4/10 (within limit); DKIM configured (selectors: google, mandrill). Issues: DMARC policy is 'quarantine', not 'reject' — spoofed mail is moved to spam rather than blocked outright.

Q: Does lofty.ai use HSTS?

No. Strict-Transport-Security header is missing. Connections can be downgraded to HTTP via man-in-the-middle attacks.

Trust rating

Good · 83/100

Procurement snapshot

0 critical findings identified — these point to architectural gaps, not just configuration tweaks.

Strengths

Known Breaches

DNS Configuration

TLS Configuration

Security Headers

Estimated remediation effort: 2–5 hours

Based on a passive external scan — supplement with vendor-provided attestations, not a replacement.

Trust Score Trend

→ No change 1 scan · Last scanned February 18, 2026

Your rating Industry average

Score

100 75 50 25 0

lofty.ai

83/100

Compliance & Certifications

Not yet verified

PCI-DSS

AOC not on file

3rd party · QSA

SOC 2 Type II

Audit report not on file

3rd party · AICPA

DORA

Not on file

EU regulatory

Incident History

No public breaches on record

Security Posture

2 items need attention

8 passed

Turn on HSTS (forces browsers to always use HTTPS)

HSTS Header

< 1 hour High

This puts visitor logins and session data at risk of interception on untrusted networks. lofty.ai doesn't send the HSTS header, so a browser can still be tricked into connecting over plain, unencrypted HTTP instead of HTTPS — an attacker on the same network (e.g. public wifi) can exploit that gap to intercept traffic. Turning HSTS on tells every browser "always use HTTPS for this site, no exceptions."

PCI-DSS 4.0Req 6.4.1

Required application security controls

NIST 800-53SC-8

Transmission confidentiality and integrity

How to fix this

1Add this response header to your site. You're using Amazon CloudFront in front of this site — add it there, see https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/creating-response-headers-policies.html.

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

2Before adding it, make sure every subdomain (not just the main site) also works over HTTPS — HSTS applies site-wide.

3Confirm it's live: search "http header checker" and enter lofty.ai.

4Once confirmed, submit the domain at hstspreload.org so browsers enforce HTTPS even on a user's very first visit.

HSTS guide

Report unlocked.

View all 8 passed checks

Known Breaches

DNS Configuration

TLS Configuration

Security Headers

MX Records & Mail Provider

CVE Exposure

Certificate Hygiene

Subprocessors & Tech Stack

Company Signals

Operational risk

Last funding

Employees

Trust Resources

Claim profile →

Trust Center

Not detected

DPA (Data Processing Agreement)

Subprocessors List

Tech Stack Detected

Subprocessors

Amazon CloudFrontCloudflare

Similar companies in Fintech / Payments

Appears in

Fintech / Payments vendors

109 companies scanned by LynxRadar

Vendors graded B

794 companies · LynxRadar ranking

Blocking Issues

Not enabled

Strict-Transport-Security header is missing. Connections can be downgraded to HTTP via man-in-the-middle attacks.

Likelihood: ★★★☆☆

Impact: ★★★★☆

High Priority

p=quarantine

Strengths: DMARC policy set to quarantine; DMARC pct=100 — policy applies to all mail; DMARC sp=reject — subdomains fully protected; Aggregate reports (rua) configured; SPF soft-fail (~all) configured; SPF DNS lookup count: 4/10 (within limit); DKIM configured (selectors: google, mandrill). Issues: DMARC policy is 'quarantine', not 'reject' — spoofed mail is moved to spam rather than blocked outright.

Likelihood: ★★★☆☆

Impact: ★★★☆☆