Your traces stay yours.
LoopOps ingests production telemetry, which can carry PII and prompts. In plain language: where your data lives, how long we keep it, how it is protected, and how to get it deleted. No "enterprise-grade" hand-waving.
LoopOps is in alpha. We do not hold SOC 2 / ISO / HIPAA attestations yet. If your compliance process requires a certified vendor today, we are not there — tell us what you need and we will share the roadmap and a DPA. A company whose product refuses to fake a verdict is not going to fake a badge.
Where your data lives
Telemetry lands in an isolated data lake, queried back only through scoped, server-built reads — every query carries a WHERE tenant_id = … AND project_id = … clause built from your key, never trusted from the request. Control-plane token lookups live in a separate low-latency store. No third-party analytics vendor resells your traces.
Tenancy isolation
tenant_id and project_id are stamped server-side from the key that authenticated the request — never trusted from the payload. One project can never read another project's window.
Scrubbing at ingest
Default-on data scrubbing (Sentry's model): sensitive field names (password, secret, token, auth, …) are filtered, and credential patterns plus Luhn-valid card numbers are masked inside every string value and message — at ingest, so the lake never holds the raw value. Per project you can add sensitive fields, safe-list fields, or opt into email masking (GET/POST /v1/redaction, loopops_redaction); every policy change requires a reason and is recorded as its own event. Scrubbing is never retroactive.
Encryption
In transit over TLS; at rest with encrypted object storage. Keys are transmitted only as bearer tokens over HTTPS.
Keys & access
Producer and agent keys are stored only as hashes — they are shown exactly once and cannot be read back. Agent reads are bounded windows, not your firehose. Human sign-in to the dashboard and MCP is email one-time-passcode; keyed API access uses bearer keys (stored only as hashes); no project key is pasted into your agent.
Retention & deletion
Sandbox projects have free, unlimited ingest and expire if unclaimed. Archive a project to stop ingest and downgrade its keys to read-only; rows are purged by the retention job. Want everything gone now? Ask and we delete it.
The write side stays human
LoopOps never posts an issue, opens a PR, merges, or changes production. Every external write waits for a human at the approval gate — and your fixes land in your own GitHub, not a vendor's UI state.
The full HTTP surface is documented at /openapi.json. For a production tenant, a DPA, or a data question your security review needs answered, reach us — or start a sandbox and prove it on your own telemetry first.