Skip to content
SHIFTLOOM

Security evidence

How ShiftLoom Handles Connected Data

Before connecting company systems, a team should know what data is accessed, where credentials are managed, how organizations are isolated, which providers process the data, and what happens when an account is deleted.

  • Credential separationNango manages OAuth credentials outside application code.
  • Organization isolationSupabase row-level security scopes stored data by organization.
  • Deletion windowAccount data is deleted as soon as practicable and within 30 days.
1

Access starts with authorization

Connections use OAuth where supported. Nango manages OAuth credentials as a credential proxy, so integration tokens do not reach or remain in ShiftLoom application code. The data available depends on the connected provider and the permissions authorized during setup.

2

Processing remains organization-scoped

Integration data is converted into vector embeddings by Voyage AI and stored in an organization-scoped vector store in Supabase. Row-level security separates organizations. Anthropic’s Claude generates output from retrieved data, while background processing runs through isolated functions.

  • Data is encrypted in transit and at rest
  • Redis provides short-term caching of generated output
  • Inngest orchestrates background synchronization jobs
  • Vercel hosts the application and Sentry provides error and performance monitoring
3

Retention and deletion are explicit

Raw integration data is discarded after it is converted into vector embeddings. Logging out stops further reading and output generation but does not delete stored data. Account deletion removes account data, integration data, and derived content as soon as reasonably practicable and within 30 days.

ShiftLoom does not use customer data to train AI models, share it with other customers, or use it for unrelated advertising.

4

The pilot has clear limits

ShiftLoom is an invitation-only closed pilot, not a generally available enterprise platform. Teams should review their required systems, permissions, security constraints, and data-handling obligations before connecting production data. The Privacy Policy and Terms of Service remain the controlling sources.

Review the Privacy Policy and Terms of Service for the controlling account of current data handling, subprocessors, retention, deletion, and service conditions.