VendorScore · Video messaging · Data-access posture
A plain-language answer from Loom's support docs and Atlassian's sub-processor list, security measures, DPA, data-residency and AI trust pages. Loom falls under Atlassian's policies but not under Atlassian's customer-managed keys.
Get the full 5-dimension PDF — join the waitlistEvidence dated 2026-10-07, public docs only, not legal advice.
Short answer
Yes, by design (with controls): Loom stores and processes your videos, audio and transcripts in plaintext with Atlassian-managed keys; transcripts go to OpenAI, video/audio can go to Gemini.
Scored configuration: Loom Enterprise (Atlassian-managed workspace) with SSO, activity logs, data retention rules, Atlassian data residency (new site), Loom AI at defaults and Notetaker internal auto-record off.
Default setup (Notetaker auto-records internal meetings, no retention rules) scores lower; the report estimates Overall ~50.
Higher = more customer control / less inherent vendor read access for the scored configuration. A strong SOC 2 doesn't mean the vendor can't read your data.
Atlassian customer-managed keys cover Jira, Confluence, JSM and Rovo only, not Loom.
Evidence: Atlassian customer-managed keysOpenAI receives transcripts as text; Google Gemini receives video and audio for AI Agent Action Plans; providers don't retain inputs/outputs.
Evidence: Loom AI featuresLoom Notetaker auto-records internal meetings by default and announces itself in chat; any participant can /end, /pause or /delete.
Evidence: Loom meeting recording FAQsOur report flags these gaps in Loom's public documentation:
Get the full 5-dimension PDF — join the waitlist
PDFs aren't for sale yet. Join the waitlist and we'll email yours when it's ready. No calls.
Yes, by design (with controls): Loom stores and processes your videos, audio and transcripts in plaintext with Atlassian-managed keys; transcripts go to OpenAI, video/audio can go to Gemini. VendorScore rates Loom 51/100 overall from public documentation (evidence dated 2026-10-07). Scored configuration: Loom Enterprise (Atlassian-managed workspace) with SSO, activity logs, data retention rules, Atlassian data residency (new site), Loom AI at defaults and Notetaker internal auto-record off.
Loom data is encrypted at rest with AES-256 and in transit with TLS 1.2+, using Atlassian-managed keys, and there's no E2EE claim. Atlassian says "Customer-managed keys (CMK) currently support the following Atlassian apps: Jira, Confluence, Jira Service Management, and Rovo (Search, Chat, and Agents only)." Loom isn't covered, and legacy BYOK is no longer offered to new customers.
Atlassian staff access is role-based on a need-to-know basis, and we found no customer-visible log of staff access. Support is partly outsourced to PartnerHero (with sites including the Philippines and Romania) and Zendesk. Inside your own workspace, Loom Notetaker gives internal calendar invitees access to meeting recordings by default.
Not third-party models. Loom says: "The LLM providers we use do not use your inputs and outputs to improve their services." It also says no LLM provider retains your inputs and outputs. Atlassian's data-contribution change (effective 2026-08-17) uses de-identified, aggregated metadata and in-app data, but initially only for Jira, Confluence and Jira Service Management, not Loom; whether Loom will be added later is unknown. Admins can turn Loom AI off. OpenAI receives transcripts as text, and Google Gemini receives video and audio for AI Agent Action Plans.
VendorScore doesn't certify compliance; Atlassian publishes a DPA at https://www.atlassian.com/legal/data-processing-addendum. It gives at least 30 days' notice to subscribers before a new sub-processor; if you object, your sole remedy is to terminate the affected product. Loom is not HIPAA compliant.
Loom's entries on Atlassian's list at https://www.atlassian.com/legal/sub-processors include Speechmatics (transcription), OpenAI (Loom AI), PartnerHero and Zendesk (support), Mailchimp, OneSignal and Twilio-Segment. Google Gemini, which Loom's AI FAQ says receives video and audio for Action Plans, isn't listed as a Loom sub-processor; Google Vertex AI appears for Atlassian Intelligence/Rovo instead.
Yes, for new sites: Atlassian data residency covers Loom videos, transcripts and AI content, but cross-workspace features are excluded.
Every URL cited on this page. Score, key findings and FAQ: VendorScore report (loom.md), evidence dated 2026-10-07.