How we handle your data and your AI keys.

Customer Data is partitioned per Workspace at the database layer. Per-app evidence libraries are scoped per-Workspace; signals from one Operator’s app do not feed another Operator’s recommendations. There is no global learning model, and no cross-Operator embedding pool that would create signal leakage.

Workspace boundaries are enforced at every API endpoint and every algorithm-layer read path. Cross-Workspace reads are not possible without an explicit Teams parent-child relationship configured by ASOLOOP Operations.

• In transit: TLS 1.2 minimum (TLS 1.3 preferred) for all traffic between client, marketing site, application, API, and subprocessors. HSTS enabled on all public domains.
• At rest: AES-256 encryption on the primary database, object storage, and backups. Encryption keys managed by the cloud-provider KMS with workspace-scoped envelope encryption for sensitive fields (BYOK API keys, MMP credentials).
• Key rotation: Provider-managed master keys rotate per provider policy; workspace data-encryption keys rotate on credential rotation events.

Generative surfaces in ASOLOOP (text variants, screenshot composition briefs, hypothesis rationales) run on LLM and image-model APIs you connect via your own keys at Starter and Pro. Teams can use managed AI, your keys, or a mix.

• API keys are encrypted at rest with workspace-scoped envelope encryption.
• Keys are never logged, never written to telemetry, and never visible in plaintext after entry.
• You can rotate or revoke any key from Workspace Settings → AI Model. Revocation takes effect on the next generative request; in-flight requests complete on the previous key.
• Token and request costs incurred on your keys are billed by the model provider directly to you. ASOLOOP does not rebill or mark up third-party model usage.

Bounded AI is an architectural commitment, not a marketing claim. Three mechanisms enforce it on every generative output.

• AI evidence trail.Every LLM-rendered surface keeps its deterministic evidence in view — the data the model reasoned from stays visible beside the text, source-traced and revocable. You verify the claim; you don’t just trust it.
• Claim-safety validator. A mandatory gate runs before every generative output reaches you. Un-sourced revenue claims, regulated-category claims without evidence, and point-estimate revenue projections are rejected; deterministic-template fallback fires when LLM output is rejected.
• Signal traceability and revocation. Every signal ASOLOOP writes traces to a source experiment. You can inspect any signal, see which experiment contributed it, and revoke it within a 7-day window. Revoked signals immediately stop influencing future recommendations.

• Workspace roles: Owner / Member / Billing / Viewer — every role works experiments and signals; billing, membership, credentials and app deletion stay owner- or billing-scoped. Every member sees every app in the workspace (per-app scoping is on the Enterprise roadmap).
• Two-factor authentication: available at all tiers via TOTP authenticator apps; required for Owners at Teams.
• SSO and SAML: available at Teams; SCIM user provisioning available at Teams.
• Rights Administrator (Teams-only): workspace-level role authorized to approve regulated-claim attestations (healthtech, fintech, gambling, children’s apps). Required for any generative output that triggers a regulated-claim policy.
• Session management: idle-session expiration configurable at Teams (default 30 days); device-list visible in Workspace Settings.

• Every signal write is logged with source experiment, contributing actor, and timestamp.
• Every action with material effect (apply-winner, suspend experiment, revoke signal, edit Project Rule, change Workspace Settings) is recorded in the action log with actor + timestamp.
• Every action has an undo path. Suspending an experiment, revoking a signal, or turning Autopilot off takes effect on the next cycle.
• Audit log export— CSV / JSON export of the action log over arbitrary date range, available at Teams.

ASOLOOP engages the following subprocessors to operate the Service. A current list is maintained here; subscribe via it@asoloop.com to receive 30-day prior notice of new subprocessors at Teams.

8. Compliance roadmap

Honest framing: what we honor today, what we’re actively building, and what we don’t pursue.

• GDPR data subject rights

  Live

  Access, rectification, erasure, portability, and objection rights honored today. Requests routed to it@asoloop.com; responded within 30 days.

• SOC 2 Type II

  In progress

  Currently in pre-audit gap-closure. We are not making the claim of SOC 2 compliance until the audit completes. Letter of engagement available on request for Teams procurement.

• Multi-region data residency

  Roadmap

  EU and APAC data-residency regions are on the V1.1 Wave 6 roadmap (Teams tier). US-only today.

• HIPAA, PCI DSS, ISO 27001

  Roadmap

  Not currently pursued. ASOLOOPis not designed to process protected health information (PHI), cardholder data (PAN), or children’s personal information; operators in regulated categories should keep this scope outside the Service. That narrow data posture is deliberate — it is what makes the Service safe to run on regulated-vertical apps.

Found a security issue? Report it to it@asoloop.com with subject line [security]. We acknowledge receipt within 2 business days and target a triage decision within 7 days.

We commit to a 90-day disclosure window for confirmed vulnerabilities; coordinated disclosure timelines are negotiable on request. We do not currently run a paid bug bounty program; Hall-of-Fame credit is available with researcher consent.

• 24-hour internal triage from incident detection.
• 72-hour customer notification on confirmed personal-data breaches per GDPR Article 33.
• Post-incident report (root cause, customer impact, remediation, preventive measures) issued within 14 business days of resolution.
• Public status page is on the V1 GA roadmap; in the interim, incident communications go via email to Workspace Owners.

11. Security contact

Vulnerability reports, security questionnaires, and procurement-review requests: it@asoloop.com (subject line [security]). For Teams security-questionnaire intake, attach SIG-Lite or your standard form; we respond within 5 business days.