A policy says what a vendor promises to do. An architecture decides what a vendor can do. Looom is built so that client data cannot leave the client's environment, cannot be used to train AI models, and cannot be accessed by anyone outside the role-based access controls you configure. That is not a commitment; it is how the system runs.
Audit firms using public AI tools are exposing client data to models they do not control – a legal and reputational risk that grows with every deployment. Looom eliminates this risk at the architecture level. Three design principles make that possible.
Each client operates in a separate, secure environment. There is no shared pool of client data; there is no cross-client inference. Your data exists in its own boundary, visible only to the roles you authorise.
Client data is never used to train or refine AI models. The intelligence layer is trained on domain data the firm owns, not on engagement files from another client. This is an architectural constraint, not a policy promise.
AES-256 at rest; TLS 1.2+ in transit; multi-factor authentication and role-based access control at every entry point. The encryption layer is not optional and cannot be downgraded by configuration.
"Aligned to" means the platform is designed around the framework's requirements and verified at every release. Certification status, where relevant, is stated explicitly.
| Framework | Status |
|---|---|
| POPIA (South Africa) | Native Designed around the 2025 amendments – 48-hour breach reporting and data-sovereignty obligations. |
| GDPR (European Union) | Aligned Data processing and subject rights workflows designed to support GDPR-compliant deployments. Formal DPIA support available on request. |
| SOC 2 | In development Formal SOC 2 Type II certification is a current priority; controls are already architected against the Trust Services Criteria (security, availability, confidentiality). |
| ISO 27001 principles | Aligned Information security management controls designed against ISO 27001:2022. Formal certification roadmap available on request. |
| King IV | Aligned Principle 15 (combined assurance) is the basis for the Aura Combined Assurance module. |
| ISA 315 (Revised 2019) | Aligned The standard informs the documentation templates, risk identification schema, and working-paper structure across Looom and Aura modules. |
| COBIT 2019 | Aligned IT governance and control objectives mapped into the Innsyte Compliance Management module. |
The word "compliant" is reserved for frameworks where formal certification is held. "Aligned to" is used for all others.
Not without risk. A public AI tool processes whatever is pasted into it; the provider may use that content to train its models; and client data outside the firm's control is a notification event under POPIA.
The 2025 amendments reduced breach reporting from 72 to 48 hours. An AI tool that moves client data out of the firm's environment – deliberately or not – is a POPIA liability, not a productivity gain.
Looom keeps the data inside your environment, does not use it to train anyone's model, and produces outputs that are audit-ready against the frameworks your firm already follows.
That is what "private by architecture" was designed to solve — not a policy document that sits alongside the risk, but a system design that eliminates the risk at source.
A detailed architecture walkthrough, tailored to your firm's regulatory environment and data residency requirements.
Request a security briefingOr read our AI Governance White Paper — 30 pages on responsible AI in audit.