Loom AI Vendor Risk Profile
Async video messaging platform with AI-powered features including automatic summaries, chapters, action items, and filler word removal. Acquired by Atlassian in 2023.
Risk overview
Risk score: 35/100
Risk tier: Moderate
Safety rating: 66/100 (higher is better)
Lower risk scores indicate lower assessed risk.
Last verified: Apr 19, 2026 Aging
Risk dimensions
| Dimension | Risk score |
|---|---|
| Data Handling | 28/100 |
| IP Exposure | 31/100 |
| Jurisdiction | 21/100 |
| Security | 30/100 |
| Regulatory Compliance | 60/100 |
| Transparency | 65/100 |
| Business Stability | 39/100 |
| Dependency Chain | 30/100 |
| Agent Governance | Not assessed |
Analyst summary
Rating: Acceptable
Loom is Atlassian's video messaging platform with AI summarization features, and it inherits Atlassian's enterprise security posture (SOC 2 Type II, GDPR, ISO). As an Atlassian subsidiary since 2023, procurement and governance for existing Atlassian customers is typically straightforward.
Bottom line: Safe choice for Atlassian-aligned teams; confirm LLM subprocessor list before sensitive use.
Strengths
- Inherits Atlassian's mature compliance stack (SOC 2 Type II, ISO 27001)
- Explicit no-training-without-consent policy on customer videos and transcripts
- GDPR compliant with DPA available and EU data handling documented
- Tight integration with Jira, Confluence, and Atlassian Intelligence for existing customers
Concerns
- Post-acquisition integration pace has created some product roadmap uncertainty
- AI features depend on third-party LLM providers; transcript and summary flow-through needs review
- Consumer-grade video sharing defaults may surprise buyers expecting enterprise-first governance
Best for
- Existing Atlassian customers wanting asynchronous video with AI summaries
- Remote and hybrid teams standardizing on async video communication
- Engineering and support teams replacing meeting-heavy workflows
Avoid if
- You have strict prohibitions on third-party LLM subprocessors without explicit approval
- You need FedRAMP or regulated-industry certification beyond SOC 2 or ISO
- Your legal team rejects video recording by default for employee communications
Citations
- Data Handling — Trains On User Data
We do not use Customer Content to train third-party generative AI models. Loom AI features process customer video and transcripts only to deliver the requested feature.
- Governance — Privacy Policy Url
Loom Privacy Policy describes how personal data is collected, used, and shared.
- Governance — Tos Url
Loom Terms of Service govern use of the Services.
- Ip Profiles — User Owns Outputs
You retain all intellectual property rights in and to Your Content, including any Loom videos, transcripts, and AI-generated summaries.
- Jurisdiction Profiles — Incorporation Country
Atlassian announced the completion of its acquisition of Loom. Loom is now a wholly-owned subsidiary of Atlassian Corporation (NASDAQ: TEAM).
- Security Compliance — Gdpr Compliant
Loom complies with GDPR and provides a DPA for business customers processing EU personal data.
- Security Compliance — Soc2 Type2
Loom is SOC 2 Type II certified. As part of Atlassian, Loom inherits enterprise-grade security controls.