Find the revenue your business is quietly losing.

01What comes in

There is nothing to connect.

You export CSV or Excel from the tools you already run, and upload the files. Today that is the only path your records take into Loupe: no login to your CRM, no key to your accounting system, no background job reaching into anything, and nothing pointing the other way — Loupe reads, and has no ability to write back. Live connectors were descoped on purpose. You do not need another integration.

CheckOne import endpoint, and no scheduled sync of any kind.

02What is actually stored

The columns you mapped. Not your file.

Import shows you a preview and asks you to map your columns onto the fields a detector needs. Only those fields are written — every other column in that spreadsheet is dropped at the door, and the file itself is never kept, only its name. When you re-upload a record type the newest file is the one your reports use, and earlier uploads are kept until replaced or pruned so your numbers stay explainable. We do not state a retention period here, because there is no prune enforced in code yet and a period we do not enforce would be a worse claim than none.

CheckThere is no file store attached to this product — no bucket, no object storage.

03In transit, and at rest

TLS you cannot opt out of.

Every request is HTTPS, and the domain is HSTS-preloaded for two years, so a browser refuses to talk to it in plaintext at all. At rest your rows sit in Cloudflare D1 and are encrypted by the platform. We do not add a second, application-level encryption layer over your records — we would rather write that down than let a padlock icon imply it.

CheckStrict-Transport-Security: max-age=63072000; includeSubDomains; preload

04One workspace, one wall

Your workspace id is inside the query, never a filter after it.

D1 is SQLite and has no row-level policies, so isolation lives in application code — which means one forgotten clause would be enough. Because that is true, it is pinned by a test that reads every prepared statement in the codebase and fails any that touches a workspace-scoped table without constraining by workspace, then seeds two workspaces into a real database and proves nothing crosses. Nothing is pooled either: you are measured against your own history, never against other companies.

Checksrc/lib/tenant-isolation.test.ts

05Who can open it

Two factors on the door, four roles behind it.

A password never opens an account on its own — every password sign-in also needs a six-digit code emailed to the address on file, and an unverified address gets the verification screen instead of the product. Inside a workspace, four roles decide what each person may do; the table fails closed on a role it does not recognise, and nobody can grant a role above their own. There is no support-impersonation route and no staff view of your findings. Direct database access exists, as it does at every hosted company, and it is limited to named people — we would rather say that than imply a barrier the code does not have.

Checksrc/lib/auth/rbac.ts — a capability table, not a role check at each call site.

06What gets written down

That something happened. Never what was in it.

Sign-ins, role changes, invitations, imports and deletions are recorded as an event name and an account id. No record contents, no email addresses, and never a whole IP — addresses are truncated to a /24 before they are stored. Rows are pruned after 365 days. One honest limit: that trail is not yet readable from inside the portal, so today you would have to ask us for it.

Checksrc/lib/audit/log.ts — the fields it refuses to accept are listed at the top.

07What the AI sees

No model sees your records.

Every figure is computed by deterministic software from your own rows — run it twice on the same records and you get the same answer, which is what makes the arithmetic something we can show you. Nothing about your business is sent to a model provider, because there is no such call anywhere in the product.

CheckNo model provider SDK, endpoint or binding exists in the codebase.

08Leaving

One button, one transaction.

Deleting your account runs as a single database transaction: all of it goes, or none of it does. If you were the last person in the workspace it takes the workspace with it — imports, finding state, invitations, audit rows and rate-limit counters. You type the words to confirm, and the screen tells you how many imports are about to disappear before you do.

Checksrc/app/api/account/route.ts — the delete is one db.batch(), which D1 commits atomically.

What we do not claim. We hold no SOC 2 report and no ISO certificate, and there is no badge on this page pretending otherwise. A SOC 2 Type II audit is on the roadmap; when it is done you will be able to read the report rather than look at the logo. Backups, incident response and the platform-by-platform detail are on the security page.