How Loam stores, protects, and deletes your data.

The questions a careful person actually asks.

Before the detail below, here is the short version of who can see your data, what protects it, and where the honest gaps are. Every line is expanded further down the page.

The memory that makes the team work.

To support continuity, Loam stores account-scoped session and project records in the database. Some generated audio is stored separately as server files. The inventory below states the boundary:

• Account basics — your email, name, and phone number. Your phone is used for sign-in verification and the team's voice calls.
• Your sessions — the transcripts of your work with the team, and the documents, code, and audio produced in them.
• Team memory & project context — selected decisions, preferences, corrections, findings, and open work that can be retrieved for later sessions.
• Calls — conversation transcripts stored as plaintext for memory synthesis. For Meet the Team, Call Team, and ReachOut calls, audio recordings (where fetched) are stored in the database and cleared on a 30-day schedule. Full call records do not currently auto-expire; they remain until account deletion or cleanup by an authorized Loam administrator. Morning Read and Studio audio are server files and require Loam-operated cleanup after account deletion. Authorized Loam administrators can access cross-account call logs and transcripts for service operation and support.

Secrets encrypted. Accounts isolated.

• Every secret is encrypted at rest. Your API keys, connected-service tokens (like GitHub), and any provisioning credentials are encrypted with Fernet (AES-based) symmetric encryption. The encryption key is held outside the database, and rotating it is a supported operation.
• Passwords are hashed, never stored. We hash passwords with bcrypt and a per-password salt. We can't read your password, and we never store it in the clear.
• Strict customer-to-customer isolation. Customer-facing requests are scoped to the authenticated account, so one customer cannot reach another’s memory, projects, or sessions. Authorized Loam administrators have separate operational access to call logs and transcripts.
• Encrypted in transit. All traffic to Loam is served over TLS (HTTPS).

Every data type, line by line.

The whole picture in one table — what each kind of data is, whether it's stored, whether it's encrypted at rest, whether it stays searchable, and whether you can delete it.

Voice & audio — feature-by-feature.

Each voice feature follows its own storage model. The table below shows exactly what’s retained, how long, and whether records expire automatically.

Used for the moment, then put back encrypted.

When you connect a service like GitHub, that token is encrypted at rest and decrypted only for the moment an action runs — never cached between operations.

• You can disconnect GitHub or disable your API key at any time.
• Deleting your account removes credentials stored in the live Loam database. Generated server files and managed infrastructure follow their separate cleanup and teardown boundaries.

Delete memory, projects, or the account record.

• Reset one team member. Delete an individual team member's memory of you and your work.
• Delete a project. Remove a project you no longer need.
• Delete the account record. Behind a one-time code sent to your phone, one database transaction removes memories, sessions, projects, settings, stored credentials, and the user record together. Generated audio stored as server files requires Loam-operated cleanup; infrastructure teardown follows the applicable plan or order. Reception work orders leave the live database with the account, but delivered report files stay until Loam removes them, and intake records are kept.

What happens to source code you share.

Loam does not scan or upload repositories by default. Source code reaches Loam only when you paste it, attach it, start a workflow that requires it, or enable Workspace Indexing. Workspace Indexing is opt-in and off by default.

• Scoped to your account only. Code you share in a session is isolated to your account. No other user or account can access it.
• Not sold, not used for advertising, not used to train Loam-owned models. When a workflow requires model reasoning, content you provide may be sent to Loam's model providers — Anthropic Claude or Gemini — strictly to perform the requested task. See Model providers below.
• Removed from the live database on account deletion. Session history, including code shared in a session, is deleted in the account transaction. Disaster-recovery snapshots may retain deleted database data for the documented seven-day backup window.

What a phone or email work order keeps.

Reception takes a request by phone or email, verifies who is asking, and runs the work on an isolated review machine. Each stage keeps something different, and not all of it leaves with your account.

Verified, expiring, and revocable.

• Multi-factor for sensitive actions. A one-time code sent to your phone gates the things that matter — deleting your account, changing your number.
• Expiring sessions. Sign-in sessions expire, and logging out (or changing your password) immediately invalidates every active session everywhere.
• Repeated bad logins lock the account to blunt brute-force attempts.

The other half of the promise.

• We don't sell your data or hand it to advertisers.
• We don't build location or device-fingerprint profiles of you.
• We don't store your payment-card details — billing is handled by our payment processor; we keep only a customer reference.

Who performs the AI work.

Loam uses external model APIs to perform coding, review, synthesis, memory, and voice-related workflows. Depending on the feature, session content, code snippets, documents, prompts, or generated outputs may be sent to those providers to complete the requested task.

Loam does not sell customer data, use customer content for advertising, or train Loam-owned models on customer content.

• Anthropic Claude — Claude Code uses the developer’s configured Anthropic account for supported editor workflows. Loam server-side model work uses a Loam-managed provider key during an active trial and for admin accounts; after the trial, the customer’s configured Anthropic API key is required.
• Gemini API — used server-side for image generation in Build Mode when enabled. Calls originate from Loam’s infrastructure and use a Loam-managed provider key; customers do not configure or pay for a Gemini key.