Security and trust
Each firm has its own database schema. Each firm has its own encryption key for its files. Loopbooks keeps your data, files, backups, logs and AI processing in the region that you choose. Loopbooks staff can not see your data without your approval.
- Isolation: one schema for each firm and each client, row level security, isolation tests on each change.
- Sign in: short tokens (15 minutes) in HttpOnly cookies, single sign-on, and audited support access that you approve.
- Encryption: TLS 1.2 or later, and encryption at rest. Each firm has its own key for its files, and the key service rotates it. When we delete a firm, we destroy its key, so nobody can read its files after that.
- Database backups: the storage of the cell encrypts the database and its backups at rest. They do not use the key of the firm. When we delete a firm, a database backup keeps a copy of its data until the backup expires. Planned: a key for each firm on database backups.
- AI: an in-region model with zero retention and no training. AI reads a redacted view only. AI never changes a number without your decision.
- Audit: an append-only, hash-chained audit log.
- Status: service status. Certifications: SOC 2 Type I and ISO 27001 are planned (see the plan in our repository). We do not claim them before an auditor confirms them.
Regions
United Kingdom (London). Data types: Clients, Activities, transactions, flags and answers; Uploaded files and working papers; Database and file backups; Application logs and traces (no content); AI prompts and answers (redacted view only); Emails to the firm's clients; Users, Memberships, Grants and sign in; Plan, usage counts and invoices.
Sub-processors
Machine readable list: subprocessors.json (version 2026-10-17). Each change gets a new version. When we publish a new version, we send an email to the owners and admins of each firm, and a signed webhook.
| Region | Name | Purpose | Location |
|---|---|---|---|
| uk-south | Microsoft Azure | Hosting of the cell: compute, database, object storage, backups, keys | United Kingdom (UK South, UK West) |
| uk-south | Anthropic Claude (through an in-region endpoint, D-011) | AI review of the redacted view of transactions; zero retention; no training | United Kingdom |
| uk-south | SMTP email provider (to choose) | Emails to the firm and to its clients | United Kingdom |
Shared responsibility
| Tier | patching | keys | backups | network | identity | ai provider | monitoring |
|---|---|---|---|---|---|---|---|
| shared | Loopbooks | Loopbooks (a key for each Organisation in our key service) | Loopbooks | Loopbooks | Shared: Loopbooks runs sign in; the customer manages its members, SSO and SCIM | Loopbooks (in-region, zero retention) | Loopbooks |
| shared_plus | Loopbooks | Loopbooks (a key for each Organisation) | Loopbooks | Loopbooks | Shared, as Shared | Loopbooks | Loopbooks |
| dedicated | Loopbooks | Loopbooks (own keys for the cell) | Loopbooks | Loopbooks (own network, private link, fixed egress IPs) | Shared, as Shared | Loopbooks, or the customer endpoint by contract | Loopbooks |
| in_your_cloud | Shared: Loopbooks ships signed releases; the customer runs the cluster | Customer (customer key service) | Customer (with Loopbooks runbooks) | Customer | Shared, as Shared | Customer endpoint | Shared: metrics to Loopbooks, logs stay in the customer account |