Security & compliance
The community runs on an independently audited enterprise community platform, not something we built in a garage. Its security program is continuously monitored, and we can share its current attestations with your privacy officer on request. Last reviewed August 23, 2026.
SOC 2 Type II
Independently audited controls for security and availability, examined over a period of time rather than on a single day.
GDPR aligned
Data processing agreements, a documented lawful basis, and member rights to access, correct and delete, applied to every member.
CCPA and CPRA
California privacy rights honored for everybody. We do not sell or share personal information, so there is nothing to opt out of.
Encrypted in transit and at rest
Modern TLS on every connection, encrypted storage, least-privilege access and audit logging behind the scenes.
Penetration tested
Third-party testing and continuous vulnerability monitoring, with findings tracked to closure.
No PHI by design
We are not a covered entity and we never ask for charts, diagnoses or assessments, so a referral moves no protected health information.
01Your weekly loom hour is never recorded. Community-wide events may be, and are always labelled as recorded on the calendar and announced by the host.
02Member pages live inside the community only. Nothing is published to the open internet or indexed by search engines.
03We collect the minimum: contact details, time zone and interests. No charts, no assessments, and no advertising trackers inside the members' area.
04Staff access is least privilege and logged. Only the small support team can see an account, and only to help with it.
05We never sell or rent personal information. We advertise Friend Loom externally, and advertising platforms receive no member data from us.
06If an incident ever affects member data, we notify affected members and partner organizations without waiting to be asked.
These are the companies that process member data on our behalf, what each one does, and where it is processed. Each is bound by a data processing agreement and may use the data only to provide its service to us. We update this list before adding a new subprocessor, and partner organizations on our notification list get an email when it changes.
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Community platform | Hosts the members' area, member pages, posts and the events calendar | Name, email, profile details, posts | United States |
| Zoom | Runs the video calls and community events, and records the events labelled as recorded. Loom hours are not recorded | Display name, email, connection metadata, event recordings | United States |
| Stripe | Processes subscription payments and gift memberships | Name, email, billing address, card token | United States |
| Email delivery provider | Sends call reminders, event invitations and account email | Name, email, delivery and open status | United States |
| SMS provider | Optional text reminders for members who prefer them | First name, mobile number | United States |
| Help desk software | Runs the member help line and support inbox | Name, contact details, support messages | United States |
| Amazon Web Services | Cloud infrastructure hosting the community platform, our seating tools and encrypted backups | Account records, member content, technical logs | United States |
| Cloudflare | Hosts and protects this public website, including DNS and denial-of-service filtering | IP address, request metadata for visitors to this site | Global edge network |
| Error monitoring | Reports crashes and errors so the help line can fix what broke | Device and browser type, error details | United States |
| AI transcription provider | Transcribes recordings of labelled community events so we can draft articles from them | Event audio and video, transcript text, speaker first names | United States |
| AI writing tools | Help our editors draft articles from approved transcripts. Outputs are always reviewed by a person before publishing | Transcript excerpts, with identifying details removed first | United States |
| Advertising platforms | Run our own ads for Friend Loom on search and social. They receive no member records from us | Marketing site cookie and campaign data only | United States |
| Website analytics | Measures traffic on this public marketing site. Not used inside the members' area | Page views, referrer, device type | United States |
No subprocessor receives protected health information, because we never collect any. No subprocessor receives recordings of a weekly loom hour, because those are never recorded. Recordings and transcripts are not used to train third-party AI models.
Ask us for the platform's current trust report, our data processing addendum, and this subprocessor list as a signed PDF. We answer security questionnaires from partner organizations, and we will tell you plainly when the honest answer is "not applicable to us."
Found a vulnerability? Report it to security@friendloom.com. We will acknowledge within two business days and we do not pursue good-faith researchers. See also our terms of service and the referral partner program.