Security and data handling
Review Loopa’s approach to hosting, data access, and study-data handling. Visit our Vanta-hosted trust center or contact us to discuss your security review.
Trust centerWhere your data lives and who touches it
Hosting and region
Loopa runs on AWS. Customer data is stored in AWS US East by default; a dedicated deployment in another region is available on request.
No training on customer data
Model inference runs through Amazon Bedrock; AWS states that neither AWS nor third-party model providers use Bedrock inputs or outputs to train models (AWS, Amazon Bedrock FAQs). Loopa does not use customer data to train models, fine-tune models, or build training sets.
Encryption
Data is encrypted in transit (TLS) and at rest; customer documents are encrypted with a Loopa-managed key.
Subprocessors
On the default production path, AWS is the only subprocessor, including model inference, OCR, and email. Any optional service a customer turns on is listed in that customer's agreement.
EDC access is read-only
Loopa reads from your EDC to verify source against entered data. It never writes to it. Access is revoked on request.
Access, audit, and retention
Role-based access. Every action on every record is written to an audit trail with user and timestamp; a reason for change is required on regulatory actions (electronic signature, CAPA linkage, revealing protected health information). Retention, return, and deletion terms are set in the services agreement.
“In infrastructure and cybersecurity, trust comes down to the decisions you make every day: who can access information, how it is handled, and who is accountable. At Loopa, I want that discipline to guide how we build, so protecting study data stays central as we help clinical teams work with it.”
What is in place today
Available on request
BAA template, SOP index, and reviewer credential attestation. Request through the trust center or the contact form.
ContactAWS US East by default, with model inference through Amazon Bedrock. A dedicated deployment in another region is available on request.
No. Not by Loopa, and not by AWS or the model providers (AWS, Amazon Bedrock FAQs).
Yes.
Contact us through our Vanta-hosted trust center for current status and report availability.
Role-based access. Loopa's reviewers are credentialed, and every access is logged. Confidentiality terms are in the services agreement and the NDA signed before any study documents are shared.
Returned and deleted per the terms of the services agreement.