How Loam stores, protects, and deletes your data.
The data inventory, encryption model, provider flow, retention periods, deletion controls, and current gaps.
The questions a careful person actually asks.
Before the detail below, here is the short version of who can see your data, what protects it, and where the honest gaps are. Every line is expanded further down the page.
Can another user see my data?
No other customer can. Customer-facing access is scoped to your account and cross-account requests return not found. Authorized Loam administrators can access call logs and transcripts for service operation and support.
What if the database is breached?
Your credentials, IDE session content, team memory, and project context are field-encrypted at rest (Fernet), with the key held outside the database. Phone call transcripts are not. They are stored as plaintext, and so is the brief behind most calls the team places to you, which can quote an order’s request and terms, part of a delivered report, a Board note, what you asked for on an earlier call, Diana’s reviews, the team’s replies and summaries from your VS Code session, the transcripts of calls made from it and the team’s memory of you. So are the opening line and short summary the team writes before each call it places. Session audio you make keeps its script, which retells the session including what you typed, and its recording in plaintext too. Reception work orders, their intake records, and the body and sender of an email request are field-encrypted where they are stored, and delivered report files and the photos and attachments you send are stored as encrypted files. Passwords are bcrypt-hashed, never stored in the clear.
Does my source code leave my machine?
Only what you hand over. Loam does not scan or upload your repository by default. Workspace Indexing, which sends a snapshot, is opt-in and off by default.
Who runs the AI, and is my data sold?
Claude Code uses the developer’s configured Anthropic account for supported editor workflows. Loam server-side model work uses a Loam-managed key during active trials and for admin accounts; after a trial, the customer’s configured Anthropic key is required. Gemini image generation uses a Loam-managed server-side key. Your content is never sold, used for ads, or used to train Loam-owned models.
Can I get it all back out, or delete it?
You can delete one member’s memory, one project, or the live account database record behind a phone code. Deleting the account also removes the audio and music files made for it on Loam’s server; see every copy, and what removes it. A one-click export isn't built yet.
What happens if I leave?
Account deletion runs as one transaction across the live database records tied to your account. That database deletion is permanent; generated audio files and managed infrastructure follow the separate cleanup boundaries below.
The memory that makes the team work.
To support continuity, Loam stores account-scoped session and project records in the database. Some generated audio is stored separately as server files. The inventory below states the boundary:
- Account basics — your email, name, and phone number. Your phone is used for sign-in verification and the team's voice calls.
- Your sessions — the transcripts of your work with the team, and the documents, code, and audio produced in them.
- Team memory & project context — selected decisions, preferences, corrections, findings, and open work that can be retrieved for later sessions.
- Calls — conversation transcripts stored as plaintext for memory synthesis. For Meet the Team, Call Team, and ReachOut calls, audio recordings (where fetched) are stored in the database and cleared on a 30-day schedule. Full call records do not currently auto-expire; they remain until account deletion or cleanup by an authorized Loam administrator. Morning Read, Saturday Night and podcast audio are server files; account deletion removes them. Authorized Loam administrators can access cross-account call logs and transcripts for service operation and support.
Secrets encrypted. Accounts isolated.
- Every secret is encrypted at rest. Your API keys, connected-service tokens (like GitHub), and any provisioning credentials are encrypted with Fernet (AES-based) symmetric encryption. The encryption key is held outside the database, and rotating it is a supported operation.
- Passwords are hashed, never stored. We hash passwords with bcrypt and a per-password salt. We can't read your password, and we never store it in the clear.
- Strict customer-to-customer isolation. Customer-facing requests are scoped to the authenticated account, so one customer cannot reach another’s memory, projects, or sessions. Authorized Loam administrators have separate operational access to call logs and transcripts.
- Encrypted in transit. All traffic to Loam is served over TLS (HTTPS).
Your IDE session content, team memory, and project context are field-encrypted at rest with the same Fernet encryption that protects your credentials — stored as ciphertext, with the key held outside the database. Reception order text, caller words in intake and backlog records, and the body and sender of an email request are encrypted the same way. Delivered report files, and the photos and attachments you send with a request, are stored as encrypted files (AES-256-GCM, with a key derived from that same key). Phone call transcripts and the descriptions recorded from photos are not field-encrypted. Neither is the brief behind most calls the team places to you: every call about an order (confirming it, delivering it, saying it couldn’t be done, or a call you ordered), a call about a Board note, a call back after a call where something broke or a request may have been missed, a Build Mode call about a blocked milestone, Diana’s design reviews, and a call or session audio made from a VS Code session. It is stored with that call’s record and is deleted with the account. It can carry the order’s request and acceptance terms, the conversation on the call where it was ordered, up to 16,000 characters of a delivered codebase review or 40,000 of a dev-meeting report, the team’s delivery-confirmation note, the Board note, what you asked for on the earlier call and up to 10,000 characters of what was said on it, the project, milestone and blocker, Diana’s review and her earlier one, the team’s replies and summaries from the session, the transcripts of calls made from it (never what you typed) and excerpts of team memory; much of that is a plaintext copy of material otherwise kept encrypted. A scheduled meeting’s brief keeps only its title, time and teammate. The record’s title is plaintext too: on a call about an order it carries the first words of that order’s request, except the call that checks a request you emailed in; other titles say what kind of call it is and, depending on the call, your first name, when the earlier call was, the milestone, the meeting, the site reviewed or the workspace name. While a call is live, its record also holds in plaintext the call’s instructions, including why the team is calling and, on your own calls, how you like to be talked with, if you have answered “How you like to work”, and, when you call in or on Meg’s call about an emailed request, the handover the team receives once you are verified: what it remembers about you and that emailed request. Both are cleared when the call ends. Every call the team places also keeps, in plaintext after it ends, the opening line written for it and a short summary the team writes before dialing for the teammate to refer to; the summary can draw on the brief and title, why the team is calling, what it remembers about you and, for a scheduled meeting, the meeting’s own brief. Session audio and Build Mode runs on Loam’s server are not field-encrypted either: session audio keeps its script, which retells the session including what you typed, and its recording with the episode, and a Build Mode project run on the server keeps the project files it works from, the team’s output and the documents it makes. We also leave in plaintext the metadata used to route orders and recall information: display names, the phone number we match a return call against, and the keyword tags and short summaries the memory index searches. These remain queryable behind per-account isolation. Temporary review files have the separate boundaries described under Reception.
Every data type, line by line.
The whole picture in one table — what each kind of data is, whether it's stored, whether it's encrypted at rest, whether it stays searchable, and whether you can delete it.
| Data type | Stored? | Encrypted at rest? | Searchable? | User-deletable? | Notes |
|---|---|---|---|---|---|
| Account basics (email, name, phone) | Yes | No | Yes | Yes | Phone is used for sign-in codes and team calls. Removed on account deletion. |
| Password | Hash only | bcrypt + salt | No | Yes | Never stored in the clear. We cannot read it. |
| Session transcripts | Yes | Field-encrypted (Fernet) | No | Yes | Your VS Code session log: what you type, unless you turn that off, and the team’s replies. Session audio and Build Mode runs on Loam’s server are listed separately below. |
| Team memory & project context | Yes | Field-encrypted (Fernet) | Index only | Yes | Content is ciphertext; only the keyword tags / short summaries the index searches stay plaintext. |
| Recall metadata (names, phone-match, tags, summaries) | Yes | Plaintext | Yes | Yes | Left queryable on purpose so search and return-call matching work; protected by per-account isolation. |
| Credentials (API keys, GitHub/OAuth tokens) | Yes | Field-encrypted (Fernet) | No | Yes | Decrypted only for the moment an action runs; key lives outside the database. |
| Call transcripts | Yes | Plaintext | No | Yes | Stored as plaintext for memory synthesis (not field-encrypted like session content). No automatic record expiry today; removed on account deletion or cleanup by an authorized Loam administrator. |
| Your server connections | Yes | Partly | No | Settings, Servers | The key Loam made when you pasted the connect line, and each project’s publishing steps, are encrypted. The server’s address, the project folder, the account the app runs as, and the live address are not. A short section about the server goes into the team’s notes for the project, which are encrypted. Removing each project’s steps and then the server in Settings deletes its connection, its key and the team’s server records; delete the loam account on the server to close access there. See what Loam can do today. |
| Call briefs | Yes | Plaintext | No | Account deletion | What most calls the team places to you start from: every order call (confirming, delivering, couldn’t be done, a call you ordered), Board-note calls, calls back after a call that went wrong, Build Mode blocker calls, design reviews, and calls or audio made from a VS Code session. Can carry the order’s request and acceptance terms, the ordering call’s conversation, part of a delivered report, the team’s delivery note, the Board note, what you asked for on the earlier call and up to 10,000 characters of what was said on it, the project and blocker, Diana’s reviews, the team’s replies and summaries from the session, the transcripts of calls made from it (never what you typed) and excerpts of team memory. Titles are plaintext too, and an order call’s title carries the first words of its request (not the emailed-request check). While a call is live, its instructions, including how you like to be talked with on your own calls, and the handover the team receives after you verify are plaintext; both are cleared when the call ends. Each call’s opening line and the short summary written before dialing, which can draw on the brief, why the team is calling, team memory and a scheduled meeting’s own brief, stay in plaintext after it ends. Removed on account deletion. |
| Session audio and Build Mode runs on our server | Yes | Plaintext | No | Account deletion | Session audio you make keeps its script, which retells the session including what you typed, and its recording with the episode. A Build Mode project the team runs on Loam’s server keeps the project files it works from, the team’s output and the documents it makes; deleting the project alone keeps them. Removed on account deletion. |
| Call recordings (audio) | If fetched | No | No | Yes | Stored only for calls that completed (non-voicemail, with a conversation ID). Cleared on a 30-day schedule; status becomes “expired.” The remaining call record does not auto-expire. |
| Reception work orders | Yes | Field-encrypted (Fernet) | No | Account deletion | Your request in your words, acceptance terms, revision requests, notes about the order, the delivery receipt, and the email or call context attached to it are field-encrypted. The order’s status, type, and dates stay plaintext so the board can sort and route it. There is no per-order delete. A call brief can carry plaintext copies of some of these (see Call briefs). Reception, stage by stage. |
| Reception intake records | Yes | Field-encrypted (Fernet) | No | Account deletion | A short audit record of each request and any clarifying question and answer, including your words. Your words, the question, and the choices offered are field-encrypted; a one-way fingerprint of your words is kept in plaintext to recognize a repeated request. Deleted with the account. |
| Delivered review reports | Server files | Encrypted files (AES-256-GCM) | No | Account deletion | Includes the lines the report quotes and the list of files reviewed. Stored encrypted on Loam’s server and deleted with the account. The call that walks you through it carries up to 16,000 characters of a codebase review, or 40,000 of a dev-meeting report, in its plaintext brief (see Call briefs). |
| Email requests | Yes | Body and sender encrypted | No | Account deletion | The message body, the sender’s email address, the authentication headers that name it, and text extracted from attachments are field-encrypted. The attachment files are stored encrypted. The sender’s display name, recipients, and subject are not. The email address on your account stays plaintext, because sign-in looks it up. Removed on account deletion when the message was matched to your account. |
| Source code | Only if shared | As session content | No | Yes | No default repo scan. Reaches Loam only via paste, attach, a workflow that needs it, or Workspace Indexing (opt-in, off by default). |
Every copy, and what removes it.
For each kind of record: where its copies are kept, what protects each one, whether anything removes it on a schedule, what you can do to delete it, and what happens if a server stops partway through. Checked against source on 2026‑10‑15.
| Record | Copies | Protection | Expiry | How to delete it | After a crash |
|---|---|---|---|---|---|
| Call transcripts | The call record. A recap in each teammate’s memory and in the caller memory. Up to 10,000 characters of it in the brief of a call back after that call. On a phone order, the review brief on the review machine. | Call record and call-back brief: plaintext. Memories: field-encrypted. Review brief: not application-encrypted. | None for the call record. The review brief goes with its job folder (8 days). | Account deletion. There is no per-call delete. | A recap that did not get written is retried every 15 minutes, up to 3 times, for 72 hours. |
| Call briefs | The brief and its title, kept with the call. A call back’s brief is also copied into your encrypted session log. The opening line and short summary on the call record. While a call is live: its instructions and the handover after you verify. | Brief, title, opening line and summary: plaintext. Session-log copy: field-encrypted. Live-call fields: plaintext. | None for the brief, opening line and summary. Live-call fields are cleared when the call ends. | Account deletion. | A call that never reported its end is closed by a cleanup check, which also clears the live-call fields. |
| Team memory and its index | One memory record per teammate, index entries, and the history of how each teammate reads the relationship. New: after a teammate answers your email, one entry that keeps every word you wrote and every word of the reply. A message you forwarded is noted, never copied. | Memory, index content and history: field-encrypted. Index keywords and one-line summaries: plaintext. | None. | Resetting one teammate deletes, in one step, that teammate’s memory record, its own index entries with your notes on them, its history, and the portrait built from that history. Board items it filed about a work order, call or email stay with that record. A call that ended shortly before the reset and was not yet recapped can still be recapped afterwards. Account deletion removes all of it. | The email entry is written once per email; a failed write leaves nothing behind and does not affect the reply. |
| Caller memory | One record per account and calling number: recent call notes and lasting facts. | Field-encrypted. The phone number it is filed under is plaintext. | None. Call notes and lasting facts are only ever added to; nothing is trimmed to make room. | Account deletion. | — |
| Work orders and their files | The order, its revision requests, intake records and delivery receipts. Delivered reports and email attachments in your account’s folder on Loam’s server. Plaintext copies of some order text in call briefs. | Your words, terms and receipts: field-encrypted. Status, type and dates: plaintext. Files: encrypted (AES-256-GCM). | None. | Account deletion removes the records, then your folder. Erasing an order from your Board cancels it and keeps the record. | If the server stops after the records are deleted but before the folder is, the folder stays until Loam removes it by hand. |
| Photos sent during a call | The photo file, and a record of what the team could see in it. | File: encrypted (AES-256-GCM). Description: plaintext. | 90 days, checked four times a day. Spent upload links: 30 days. | Account deletion removes the files, then the records. | The file is removed before its record, so an interrupted cleanup finishes on the next check. |
| Email you send to the team | The message, its attachments and the text read from them, and the email conversation record. On the same message, the team’s reading of your request and the reply it sent (up to 4,000 characters). The memory entry above. | Body, sender address, sign-in checks, attachment text, the team’s reading and its reply: field-encrypted. Attachment files: encrypted. Display name, subject and recipients: plaintext. | Email never matched to an account: deleted with its files 30 days after it arrives, checked four times a day, once the team has moved it out of the inbox and no reply to it is in doubt. Until then it is kept. Email matched to your account: none. | Account deletion, for email matched to your account. The 30-day cleanup, for email never matched to an account; its email conversation record is kept. | The 30-day cleanup removes the files before the records, so an interrupted cleanup finishes on the next check. Not established otherwise. |
| Session audio | The team’s replies from the session (never what you typed), the script, and the recording, in the database. A playback copy of the recording cached as a file on Loam’s server. | Plaintext. | None. | Deleting the episode from your audio library removes the recording, script and every cached copy; the team’s replies stay until account deletion. Account deletion removes all of it, cached copies included. Deleting a project keeps all of it. Cached copies left by account deletions before this change are still on the server until Loam removes them. | Cached copies are removed after the records. If the server stops in between, or a copy cannot be removed, it is left on the server; nothing removes it later. Not established otherwise. |
| Build Mode files on our server | The project files, the documents made, and the team’s messages, in the database. | Plaintext. | None. | Account deletion. Deleting a project keeps them. | Not established. |
| Episode audio (Morning Read, Saturday Night, podcasts) | One audio file per episode on Loam’s server, and its path in the database. Morning Read and Saturday Night also keep their script there. | Plaintext. | None. | Deleting a Morning Read or Saturday Night episode from your audio library removes its audio file and its record for good; one still being made can be deleted once it finishes. There is no delete for a single podcast episode. Account deletion removes every episode’s record and audio file, and your Morning Read folder. Deleting a project does not remove its podcast files. Files left by account deletions before this change are still on the server until Loam removes them. | A Morning Read interrupted mid-production is marked failed when the server restarts. Deleting one episode removes its file first; if the file can’t be removed, nothing is deleted and you can try again. Account deletion removes the files after the records; if the server stops in between, or a file cannot be removed, it is left on the server, and nothing removes it later. |
| Music: songs, stems and downloads | Each song’s audio files, its stems and its downloads, in your account’s music folder on Loam’s server. The song’s record: title, style, lyrics, and for a Playground song your description until the song is written. The music service that made the song may keep its own copy. | Lyrics, your description and the links to stems and downloads: field-encrypted. Title and style: plaintext. Audio files: not application-encrypted. | None. Your Playground description is erased once the song is written. | Deleting a song removes its audio files, stems and downloads from Loam’s server, then its record, for good; a song still being made, or with a stem or download still being prepared, can be deleted once that finishes. Songs made from it and singers saved from it stay. Taking a song out of the rotation instead keeps its files. Account deletion removes the records and your whole music folder. Copies the music service keeps are not covered. | Deleting one song removes its files before its record; if a file can’t be removed, the song stays listed, possibly without its audio, and deleting it again finishes the job. For account deletion, the folder is removed after the records. If the server stops in between, or the folder cannot be removed, it is left on the server, and nothing removes it later. Music folders left by account deletions before this change are still on the server until Loam removes them. |
| Music: your uploads and saved singers | A recording you upload, and a recording you make a singer from, as files in your account’s music folder on Loam’s server, with a record of each. The music service may keep its own copy of each upload and of each singer it builds. | Files: not application-encrypted. Names: plaintext. | None. | Deleting an upload removes Loam’s file and its name; the record stays, so a song made from it is still known to come from an upload. Deleting a singer hides it and removes the recording it was made from. The music service has no delete, so it may keep its own copy. Account deletion removes your whole music folder. | The record changes before the file is removed. If the server stops in between, the file stays in your music folder until account deletion. |
| Call recordings | The audio, on the call record in the database, for calls where it was fetched. | Not encrypted. | Cleared 30 days after it was fetched; the call record stays. | Account deletion. | The 30-day check runs again on the next cycle. |
| Repository snapshot for a review | A one-commit copy of your repository on the review machine. | Not application-encrypted. | Removed when the run ends. Delivery is refused unless the run reports it removed. | Automatic; account deletion does not reach the review machine. | The daily age cleanup does not cover it. A stuck hand-off is cleaned up by Loam’s server; otherwise it stays until removed by hand. |
| Job folder on the review machine | The brief (which can include the ordering call’s transcript), the draft report and its sources. | Not application-encrypted. | A daily cleanup removes a folder once nothing in it has changed for 8 days. | The age cleanup only; account deletion does not reach it. | A folder left behind by a crash is removed by the same age cleanup. A folder the cleanup cannot safely remove is skipped and named in the cleanup’s log; it no longer stops the other folders being removed. |
| Job folder on the publishing server | The working folder for an order that publishes a site. | Not application-encrypted. | Removed 7 days after the order is delivered, closed, or erased from your Board, and untouched for 7 days. | Erasing the order from your Board makes its folder eligible. | Checked hourly; a folder it does not recognize is reported to Loam, never deleted. |
| Local collaboration history | One inbox file on your own Windows machine. | Not application-encrypted. Readable only by your Windows user and SYSTEM. | None. | The helper’s uninstall, with its remove-history option. Disconnecting and account deletion keep it. | — |
A delete for a single call, order, or email. A history you can view of who opened or changed your records. A bulk export of your data. Retention periods you can set yourself. Database backups can hold deleted records for the 7-day backup window described below.
Voice & audio — feature-by-feature.
Each voice feature follows its own storage model. The table below shows exactly what’s retained, how long, and whether records expire automatically.
| Feature | Transcript | Audio storage | Audio cleared | Record cleared | Notes |
|---|---|---|---|---|---|
| Meet the Team | Plaintext | Database (binary, if fetched) | 30 days | No auto-expiry | Recording stored as nullable binary. Cleared automatically; status becomes “expired.” User-deletable via account deletion. |
| Call Team | Plaintext | Database (binary, if fetched) | 30 days | No auto-expiry | Same model as Meet the Team. Trigger = manual; source = ide. |
| ReachOut | Plaintext | Database (binary, if fetched) | 30 days | No auto-expiry | Automated and on-demand triggers share the same storage model as above. |
| Reception | Plaintext | Database (binary, if fetched) | 30 days | No auto-expiry | Spoken verification codes are redacted before the transcript is stored. The call transcript is copied into the brief sent to the isolated review machine. Removed from the live database on account deletion. |
| Morning Read | — | Server file (path in database) | Account deletion | Account deletion | No auto-expiry. Account deletion removes the database path and the server file. Email download links expire after 48 hours; in-app download requires an active session. |
| Studio | — | Server file (path in database) | Account deletion | Account deletion | No auto-expiry. Account deletion removes the database path and the server file. Email download links expire after 72 hours; in-app download requires an active session. |
Used for the moment, then put back encrypted.
When you connect a service like GitHub, that token is encrypted at rest and decrypted only for the moment an action runs — never cached between operations.
- You can disconnect GitHub or disable your API key at any time.
- Deleting your account removes credentials stored in the live Loam database. Generated server files and managed infrastructure follow their separate cleanup and teardown boundaries.
Supported hosted infrastructure is provisioned in Loam-managed AWS and Cloudflare accounts. Applicable resources, limits, teardown, and charges belong in the plan or order form. That is Loam-managed hosting. Provisioning in your own cloud account is planned and not available today. Publishing to your own server, one you already have, is available now in Settings, under Servers (what Loam can do today).
Delete memory, projects, or the account record.
- Reset one team member. Delete that team member's memory of you and your work, for your account, in one step: its main memory, its own index entries and your notes on them, its history of how it reads your relationship, and the portrait built from that history. What stays: Board items it filed about a work order, call or email (they stay with that record), project notes (deleting the project removes them), its log of past check-ins, and your account's own records such as calls, email and orders (see every copy, and what removes it).
- Delete a project. Remove a project you no longer need.
- Delete the account record. Behind a one-time code sent to your phone, one database transaction removes memories, sessions, projects, settings, stored credentials, and the user record together. The audio and music files made for the account are removed from Loam’s server after that transaction; infrastructure teardown follows the applicable plan or order. Reception work orders, intake records, and delivered report files are deleted with the account.
Most of your data doesn’t auto-expire — memories, session content, and project context stay until you remove them. Fetched audio recordings from phone calls (Meet the Team, Call Team, ReachOut) are cleared on a 30-day schedule. The remaining call records do not currently auto-expire; they remain until account deletion or cleanup by an authorized Loam administrator. A one-click data export isn’t built yet. Reception work orders, intake records, and report files are deleted with the account; see Reception.
The live database deletion is permanent and is not individually recoverable. Infrastructure backups exist for disaster recovery only and are not used to restore individual deleted accounts. Snapshots may contain deleted database data until they expire; the current backup window is 7 days. Audio and music files are removed from Loam’s server after the database transaction; files left by account deletions before October 16, 2026 need Loam-operated cleanup.
What happens to source code you share.
Loam does not scan or upload repositories by default. Source code reaches Loam only when you paste it, attach it, start a workflow that requires it, or enable Workspace Indexing. Workspace Indexing is opt-in and off by default.
| Workflow | Reads local files? | Sent to Loam? | Stored? | Default |
|---|---|---|---|---|
| Normal session | Pasted or typed content only | Yes, if you provide it | Session history | On |
| Build Mode | Files required for requested milestone | Yes, via session context | Session history | User action |
| Code Review | Diffs and review anchors | Yes, via session context | Review findings and anchors | User action |
| Reception review (phone or email) | No local files; the repository you registered | A read-only, one-commit snapshot goes to an isolated review machine, not to Loam’s database | The report, the lines it quotes, and the list of files reviewed | Your request |
| Workspace Indexing | Full project tree and file contents | Yes, to assemble session context | Not persisted in Loam's database | Off by default |
- Scoped to your account only. Code you share in a session is isolated to your account. No other user or account can access it.
- Not sold, not used for advertising, not used to train Loam-owned models. When a workflow requires model reasoning, content you provide may be sent to Loam's model providers — Anthropic Claude or Gemini — strictly to perform the requested task. See Model providers below.
- Removed from the live database on account deletion. Session history, including code shared in a session, is deleted in the account transaction. Disaster-recovery snapshots may retain deleted database data for the documented seven-day backup window.
A future version of Loam will support organizational accounts where memory is institutional and shared across team members. That model is in development and does not exist today. All memory is currently per-user and isolated.
The task you hand over, and the record it leaves.
Codex collaboration is off by default and requires explicit helper setup and exact conversation pairing. The local inbox holds scoped handoff text, binding metadata, approved scope, and delivery receipts. Handoff content is supplied to the selected coding agent and its configured provider to perform that task; connecting does not authorize an unrestricted repository upload or a release.
The helper stores its SQLite inbox under %LOCALAPPDATA%\Loam\Collaboration. These records are not application-encrypted. The installer limits directory access to the current Windows user and SYSTEM, and the inbox does not store provider credentials. Disconnecting retains history. Hosted account deletion does not delete local collaboration records; the helper’s uninstall option can explicitly remove them.
Loam retains account and project memory, independent QA, and deployment under configured authorization. Readiness acknowledgment, task completion, a saved commit, and a verified live deployment are distinct events.
What a phone or email work order keeps.
Reception takes orders by phone or email, accepts photos during a call, and delivers the finished work to your inbox. Code reviews use an isolated review machine. Code changes by phone are available: a verified caller confirms the change, the team makes it on the project connected through GitHub, and it goes online through the steps you approved for your own server or, if your project already publishes itself from GitHub, through that. Saved and live are reported separately. See what Loam can do today. A change by phone needs Allow publishing turned on for the project (Settings, under GitHub), and either steps you approved for your own server or a project that already publishes itself from GitHub. It changes only what the caller confirmed, records what it ran, and is called live only after Loam checks that your live site shows the new version. Asking for a change is not permission for every step after it (what Loam can do today). Order records and delivered report files are deleted with your account; temporary review files and copies delivered outside Loam have the separate boundaries below.
Caller ID identifies an account; it does not verify you. Ordering by phone requires a text code sent to your registered phone and a phrase sent to your registered email, or a Duo approval on Meg’s line when enrolled. The server checks both factors, limits attempts, and refuses access without the registered contact details. Email orders must be matched to the account before work is accepted.
Quiet hours are on by default. Only you can switch them off in your account settings; an administrator cannot. They hold ordinary calls and texts outside 8 a.m.–9 p.m. in your time zone. A callback or message you explicitly requested can honor that request outside the window. A call the team marks urgent — something went wrong with your work, or a password or key may have leaked — can also come through; a text never does. Switching quiet hours off permits any hour but does not replace consent to calls and texts.
| Stage | What is kept | Encrypted at rest? | How it is removed |
|---|---|---|---|
| Work order | Your request in your words, acceptance terms, status, and the delivery receipt. The call transcript, with spoken verification codes redacted. | Mostly encrypted. Your request, acceptance terms, revision requests, the delivery receipt, and the email or call context are field-encrypted; the order’s status is not, and the call transcript is not yet. | Account deletion. There is no per-order delete; erasing an order from your board cancels it and keeps the record. |
| Intake and backlog records | A record of each request, any clarifying question and answer, and the resolution of outstanding work. | Your words, clarifying questions, answers, and recorded owner identity are field-encrypted. Routing metadata and a one-way request fingerprint remain plaintext. | Deleted with the account. |
| Photos sent during a call | The photos you upload through a single-use link, plus a record of what the team could see in each photo. | Photo files are encrypted (AES-256-GCM). The recorded descriptions and file metadata are not field-encrypted. | Photos and their analysis records are removed after 90 days, or with account deletion. Spent or expired upload-link records are cleared after 30 days. |
| Repository snapshot | A read-only, one-commit copy of the repository you registered, fetched with a short-lived credential that can only read that repository. The review runs on an isolated machine; preparation also uses a temporary working copy on Loam’s server. | Not application-encrypted | Removed when the run finishes, fails, or is cancelled. Delivery is refused until removal is confirmed. If the machine itself crashes mid-run, the copy stays until it is removed by hand. |
| Job folder on the review machine | The draft report and the sources it was built from. | Not application-encrypted | Deleted by a daily cleanup once it is more than 8 days old. |
| Delivered report | The report, the lines it quotes, and the list of files reviewed. Saved as a file on Loam’s server and sent to you as an email attachment, or as a link that expires after 7 days when the file is too large to attach. | Encrypted file (AES-256-GCM) | Deleted with the account. |
| Development-meeting folder | When a development meeting says go, its project folder is delivered with the report. With your repository write permission, the plan folder is also saved into that repository’s docs folder. A copy is kept on Loam’s server. | The server copy is an encrypted file. The plan folder committed into your repository is not encrypted by Loam, including in a local checkout of that repository on Loam’s server | Remove it from your repository like any other commit. The server copy is handled like a delivered report. |
There is no self-service way to delete a single work order or its report; deleting the account deletes all of them. The call transcript is not yet encrypted at rest, and neither are the working files on the isolated review machine while a run is in progress. While a repository review is prepared, the repository’s source is read into a temporary working copy on Loam’s server that is not encrypted and is removed when that step finishes. To remove a single order, ask Loam through the contact page.
Verified, expiring, and revocable.
- Multi-factor for sensitive actions. A one-time code sent to your phone gates the things that matter — deleting your account, changing your number.
- Expiring sessions. Sign-in sessions expire, and logging out (or changing your password) immediately invalidates every active session everywhere.
- Repeated bad logins lock the account to blunt brute-force attempts.
The other half of the promise.
- We don't sell your data or hand it to advertisers.
- We don't build location or device-fingerprint profiles of you.
- We don't store your payment-card details — billing is handled by our payment processor; we keep only a customer reference.
Who performs the AI work.
Loam uses external model APIs to perform coding, review, synthesis, memory, and voice-related workflows. Depending on the feature, session content, code snippets, documents, prompts, or generated outputs may be sent to those providers to complete the requested task.
Loam does not sell customer data, use customer content for advertising, or train Loam-owned models on customer content.
- Anthropic Claude — Claude Code uses the developer’s configured Anthropic account for supported editor workflows. Loam server-side model work uses a Loam-managed provider key during an active trial and for admin accounts; after the trial, the customer’s configured Anthropic API key is required.
- Gemini API — used server-side for image generation in Build Mode when enabled. Calls originate from Loam’s infrastructure and use a Loam-managed provider key; customers do not configure or pay for a Gemini key.
Provider retention and training behavior is governed by each provider's API terms and Loam's account configuration with that provider. Customers should review those provider terms as part of any security or procurement review.
The team remembers you. You decide what it keeps.
The account-scoped engineering record is a core product surface, not a hidden profile. The access, storage, retention, deletion, and provider limits are stated above. If a security review needs evidence beyond this page, contact Loam.
The core storage and access claims on this page were last checked against source on 2026‑07‑20. Reception verification, photo retention, encryption exceptions, and deletion disclosures were checked against source on 2026‑09‑16. The quiet-hours text, including the urgent-call exception, was checked on 2026‑09‑30. The plaintext call briefs, call openers and summaries, session audio and Build Mode runs on Loam’s server were checked on 2026‑10‑01. Ask for a current verification packet before approval.