Skip to the content
The operating system for desk work that lives in files
Try a sample
Legal · effective 2026-09-23

Security

Effective 2026-09-23.

This page describes how BaseLoom protects the service and your data, and how to report a security problem to us. It describes measures in place today. We do not hold a security certification such as ISO 27001 or SOC 2, and we have not had an independent penetration test. We will say so here when that changes.

1. Security overview

1.1 Your files are not stored

Files you upload and text you paste are processed in the memory of the server handling your browser session. They are not written to disk, not saved in a database, and not included in backups. When the session ends, they are gone. This is our main protection: data we do not keep cannot be stolen from us later.

1.2 Your files stay with us and our host

The tools run deterministic code and reference tables. Your files are not sent to AI model providers or any other third party. The only provider that handles them is our hosting provider, Microsoft Azure (Microsoft Azure, East US 2 (United States)), whose servers hold the session memory.

1.3 Encryption in transit

All traffic between your browser and our servers is encrypted with TLS.

1.4 Access control

  • Only the proprietor has administrative access to our systems.
  • Multi-factor authentication is required on all administrative accounts (hosting, payments, email, code repository).
  • Automated components run with only the permissions they need. Service credentials are kept in the hosting provider's secret store, not in source code.

1.5 Infrastructure

  • The service runs in containers on Microsoft Azure's managed platform. Physical and data center security are provided by Microsoft under its own certified controls.
  • Each session's data is held in that session's memory and is not shared with other sessions.

1.6 Logging and monitoring

  • Server logs record requests and errors, not file contents. They are kept for up to 30 days.
  • Error reports, where enabled, exclude file contents.

1.7 Software maintenance

We track and apply security updates to the software libraries and container images we use.

1.8 What we do keep, and backups

We keep billing, subscription, terms-acceptance and support records. The terms-acceptance record stores a one-way hash of your license key, not the key itself, and no IP address. Backups cover these records only.

1.9 Payments

Card details are handled by Dodo Payments, our seller of record, and never reach our systems.

1.10 Your part

  • Keep your license key confidential; it grants access to your subscription.
  • Upload only what a tool needs. Use redacted or de-identified data where you can.
  • Do not upload protected health information unless a Business Associate Agreement is signed (https://app.baseloom.app/?view=legal&doc=baa).
  • Do not upload ITAR technical data, EAR-controlled technology or Controlled Unclassified Information (https://app.baseloom.app/?view=legal&doc=aup). Our servers are ordinary commercial cloud, not FedRAMP or GCC High, and the proprietor is not a US person.

1.11 Incidents

If a security incident affects personal data in your files, we will notify you without undue delay and in any case within 72 hours of becoming aware of it, as set out in our Data Processing Addendum (https://app.baseloom.app/?view=legal&doc=dpa). Where Indian law requires, we also report cyber incidents to CERT-In.

2. Vulnerability disclosure policy

We welcome reports from security researchers and anyone who finds a problem.

2.1 How to report

Email legal@baseloom.app with the subject "Security report". Please include:

  • a description of the issue and where it occurs (URL, tool id, parameter);
  • steps to reproduce it, and a proof of concept if you have one;
  • the impact you believe it has;
  • how to reach you.

Please do not include real personal data in your report.

2.2 Scope

In scope:

  • https://app.baseloom.app and its tools;
  • our API endpoints on the same domain;
  • the license-key check and terms-acceptance flow.

Out of scope:

  • Dodo Payments checkout pages, Microsoft Azure, and other third-party services (report those to their owners);
  • denial of service or load testing;
  • social engineering, phishing, or physical attacks;
  • automated scanner output without a demonstrated, exploitable issue;
  • missing security headers or cookie flags without a demonstrated impact;
  • spam or email configuration issues such as SPF, DKIM or DMARC settings, unless they allow a practical attack.

2.3 Rules for testing

  • Use only the free sample data (the sandbox) or your own subscription. Do not access, change or delete data that is not yours.
  • Stop and tell us as soon as you find a way to reach other users' data or sessions. Do not go further than needed to show the issue.
  • Do not degrade the service for others.
  • Give us reasonable time to fix the issue before telling anyone else. We ask for 90 days, or less if we fix it sooner.

2.4 Safe harbor

If you act in good faith and follow this policy, we will:

  • consider your research authorized, and not pursue or support legal action against you for it, including under computer misuse or anti-circumvention laws or our Terms;
  • work with you to understand and fix the issue;
  • credit you publicly if you wish, once it is fixed.

This safe harbor covers only our own systems and our own claims. We cannot authorize testing of third-party systems. If you are unsure whether something is allowed, ask us first.

2.5 Response times

We aim to:

  • acknowledge your report within 3 business days;
  • give an initial assessment within 10 business days;
  • keep you informed until the issue is resolved.

We are a one-person business, so these are targets, not guarantees, but we take every report seriously.

2.6 Rewards

We do not run a paid bug bounty program at this time. We are grateful for reports and will credit researchers who want it.

3. Security contact

`` Contact: mailto:legal@baseloom.app Policy: https://app.baseloom.app/?view=legal&doc=security Preferred-Languages: en ``