Every claim on this site is checked
Every capability on this site carries one of three statuses:
- Working: it runs end to end today for at least one real system, with evidence in our repository.
- Partial: part of it runs. The page says, in a plain sentence, what does not work yet.
- Concept: it is designed or planned. Nothing a client can use yet.
Each status points to an entry in our claims register, with the files that prove it. A test checks every status before the site is published, and an overclaim stops the release. Working
We make four promises about your data
These promises are firm. Each one is built and tested before a pilot uses it.
Least-privilege access. We ask for the least access that works, read-only by default. Each access token covers one repository. Loom never merges, never changes workflows and never reads secrets. Partial What does not work yet: the GitHub App is not yet registered; until it is, we use a fine-grained token with the same limits.
Your system stays in your repository. Loom's output reaches your repository as files or pull requests your team reviews. Partial What does not work yet: Loom opening pull requests itself is built and tested, but not yet used on a client repository.
AI output is labelled. Drafts written by agents carry a machine-readable label. Working Pull requests Loom opens carry a label and a disclosure, and the run fails without them. Partial What does not work yet: this has been tested against simulated git hosts only.
Working copies are deleted. At the end of an engagement, one command deletes every working copy and writes a receipt. Partial What does not work yet: it has not yet been used in a client engagement.
No training on your data. We do not use your code, designs, prompts or outputs to train models, and we never sell or share them. Our commitment
The health check sends only what it says it sends
Your answers stay in your browser. If you ask for the full report, we receive your contact details, profile and area scores, nothing else. Working Report requests are deleted after 12 months. Partial What does not work yet: the daily deletion job is built and tested but not yet running; until it runs, we delete on request.
The report form uses Cloudflare Turnstile to block spam. Cloudflare processes your IP address and browser details to tell people from bots. We hold IP addresses briefly in memory for rate limiting and never store them. Partial What does not work yet: the check is built and tested, and it runs from the first release that includes it.
We publish our own scores
Loom's own control area scores 26 out of 100 on our own audit. Loom Base, our own design system, scores 73. We are rebuilding the control area on Loom Base. Working
What we do not have yet
We do not hold ISO 27001 or SOC 2 certification. The data and privacy page is a draft under review and is not a contract; for a paid engagement, the signed terms take precedence.