Industrial-grade security standards
Security is a core feature, not an afterthought. Loonar is built to protect sensitive commercial documents so you can use it with confidence and peace of mind.
What happens to your documents, step by step
-
Upload & secure storage
RFQs, proposals and attachments are uploaded and stored in encrypted storage inside your tenant.
-
Data processing inside your environment
Indexing and search/analysis processing happen within your tenant environment.
-
AI processing with Zero Data Retention
When AI is used, requests are transmitted over encrypted connections and providers are configured for Zero Data Retention, with no storage or reuse of prompts or outputs for model training or improvement.
-
Outputs stay in your tenant
Results are stored only inside Loonar within your tenant. Upon termination, data can be exported and deleted from production systems, with backups handled through standard retention cycles.
Our DPA, audit rights and sub-processor list
Data Processing Agreement
The full DPA, published openly, together with our Cybersecurity Appendix.
Read the DPA
Audit & inspection
You can run a security review. Section 9 sets out the process and the conditions.
Section 9
Return & deletion of data
Section 8 covers export and deletion when the service ends, and how backups are handled.
Section 8
Sub-processors
Appendix C lists every current sub-processor. Section 4.2 covers notice and your objection rights.
Appendix CSecurity questions we are asked most often
Where can I find your Data Processing Agreement?
It is published at www.loonarai.com/dpa, together with our Cybersecurity Appendix. You do not need to ask us for it or sign an NDA to read it.
Can we run a security review or audit?
Yes. Section 9 (Audit & Inspection) of the DPA sets out the process and the conditions.
Which sub-processors do you use?
Appendix C of the DPA lists the current sub-processors. Section 4.2 (Sub-processor changes) covers the notice you get and your right to object.
What happens to our data when the service ends?
Section 8 (Return and Deletion of Data) of the DPA sets out the export and deletion steps, and how backups are handled.
Is our data used to train AI models?
No. Customer data, prompts and outputs are never used to train, fine-tune or improve AI models, by Loonar or by our third-party providers. Where AI is used, providers are configured for Zero Data Retention, so prompts and outputs are not kept after processing.
Where is our data stored and processed?
In EU regions by default, handled in line with EU GDPR requirements. Your documents and outputs stay inside your tenant and are never shared with other customers.
Review our security documentation before you upload anything
Our security documentation is available on request, so your team can start reviewing before you upload a single document.
