For reviewers
Security and data
For security reviewers, data protection leads and procurement teams. This page describes how we work today, including where the answer is no.
Where your data lives
On your own hosting, in a region you choose, such as the UK or the EU. The region is written into your contract before any data moves.
Hosting, code, domains and other services are opened in your company's name and billed to you directly. Any transfer outside the UK or the EEA is named in the contract, with its legal basis.
Personal data
On your projects we handle personal data only on your written instructions, as your processor under UK GDPR.
- An agreement first
- We sign a data-processing agreement before any personal data reaches us. We can sign yours or send ours.
- As little as the work needs
- We ask only for the fields a task needs. Where sample or anonymised data will do, we use that.
- Impact assessment
- If a project handles personal data at scale, or makes automated decisions about people, we complete a data-protection impact assessment with you before building.
- Requests from individuals
- If someone asks about their data in a system we run, we help you answer in time. We also hand you the tools to do it yourself.
- If there is a breach
- If we become aware of a breach involving your personal data, we tell you in writing without undue delay: what happened, which data, and what we are doing about it, so you can meet your own reporting duty.
- Deletion at the end
- When we finish, we confirm in writing that our copies of your data are deleted. We list what we held, where we held it, and any records the law requires us to keep.
Access to your systems
- We ask for the narrowest access that lets the work go ahead, given per person.
- You can remove any of our access in one step, at any time.
- Every account and key created for the work is listed in the handover pack, with who holds it.
- When the work ends, we remove our access and confirm it in writing.
Outside services that handle your data
These are the kinds of outside service a project usually uses. The actual services and their regions are named in your contract before anything moves.
| Kind of service | Why it's used | What's agreed |
|---|---|---|
| Hosting and servers | Runs the system and its scheduled jobs | Opened in your name, in the region you choose |
| Databases and backups | Stores the system's data and its backup copies | On your account, with the backup schedule and restore steps agreed in writing |
| Code hosting | Holds the code and its documentation | Your company's account, with access given per person and removed at the end |
| Messages about the work, and messages the system sends | The system sends email from your own domain | |
| AI model providers | Only for an AI feature, if your project has one | Provider, region and retention named before it's built |
| AI coding assistants | Help us write and check code | Used only on code you've authorised, set not to keep your content for training, and switched off if you ask |
We tell you in writing before adding a service that will touch your data, and you can object. Nobody else works on your project without telling you first, and anyone who does is bound by the same terms.
AI and your data
- We send an AI provider only the data the task needs.
- The provider's account is set so your content isn't kept for training. Your contract names the provider, where it runs and how long it keeps data.
- A person checks the result wherever it reaches a customer, a payment or a record.
- Your staff can switch the AI step off, and the rest of the system keeps working.
- Every AI call is logged with its cost, so you can see what the feature spends.
Built into the software
Protections we build in where a system needs them. Each one is already in code we have shipped.
- Access by role, down to individual records where it matters.
- Limits on login attempts and request rates.
- Passwords stored only as secure hashes.
- Keys for connected services encrypted in the database.
- Uploaded files checked by their actual content, not their name.
- Security headers and a content security policy in the browser.
- Server settings that limit what each service can do, and block repeated failed logins.
- After a security review of the code, a check for each fix that we run again before releases.
On our largest system, integrations are watched: a person is alerted the next morning if one stops updating.
We don't hold a security certificate. We don't offer cover at night or at weekends, or a promised uptime figure. If your process requires any of these, tell us early and we'll say plainly where that leaves us.
What we don't do
-
Selling or sharing your data
Your data is used for the work you asked for and nothing else. We don't sell it, pass it on, or use it for our own marketing.
-
Training models on your data
We never use your data, code or documents to train models.
-
Regulated financial services
We build software only. We are not authorised or regulated by the FCA, and any regulated activity stays with you or your provider. We don't hold client money or provide payment services.
Paperwork you can have before a first call
- Mutual NDA
- Ours, or yours signed as issued.
- Data-processing agreement
- Ours, or yours. It covers the services used on your project, where your data is held, how long it is kept, how it is deleted and how we tell you about a breach.
- Wording on rights in the code
- The contract clause, including how reused components and open-source licences are handled.
- Supplier assessment questionnaire
- We return it completed within five working days. Where the answer is no, we write no.
- Blank project documents
- Blank versions of the written plan, the contract, the progress report, the running instructions, the handover pack and the support report.
- Company information
- Our filings are public at Companies House. If your onboarding needs anything else, ask, and we'll send it or tell you we can't.
Ask, and we'll reply in writing within one working day.
None of it is held back for later in the conversation.
Or email it to loomreach@loomreach.ai with "Supplier questionnaire" in the subject.
Policies
- Privacy policy
What we collect through this website and in correspondence, why, how long we keep it and how to ask us to delete it.
- Terms and conditions
The terms on which this website is provided and may be used.
- Cookies policy
What this site sets, what is optional, and how to change your choice from the cookie settings link at the foot of each page.