Loopion

Publisher Attestation: The information on this page is based on a self-assessment report provided by the app developer on the security, compliance, and data handling practices followed by this app. Microsoft makes no guarantees regarding the accuracy of the information.

Last updated by the developer on: October 16, 2026

General information

Information provided by Loopion to Microsoft:

Information Response
App name Loopion
ID WA200012606
Office 365 clients supported Microsoft Teams
Partner company name Loopion
Company's website https://loopion.ai
App's Terms of Use https://loopion.ai/terms
Core functionality of the app Loopion joins Microsoft Teams meetings automatically, transcribes the conversation, and uses AI to generate summaries and a list of owned, dated action items. It tracks action completion over time and sends notification-only reminders in Teams chat when actions are due or overdue.
Company headquarter location United Kingdom of Great Britain and Northern Ireland (the)
App info page https://loopion.ai
What is the hosting environment or service model used to run your app? Saas
Which hosting cloud providers does the app use? Azure, Aws, Vercel
Is AI functionality part of the app's features or workflows? Yes
Online Service interfaces Microsoft Graph (calendar/meeting sync, mail sending, user profile) and Microsoft Teams Bot Framework/Tabs SDK (notification bot, personal tab, meeting side panel). Not SharePoint, not EWS directly.

Questions

Questions or updates to any of the information you see here? Contact us!

How the app handles data

This information has been provided by Loopion about how this app collects and stores organizational data and the control that your organization will have over the data the app collects.

Information Response
Does the app or underlying infrastructure process any data relating to a Microsoft customer or their device? Yes
What data is processed by your app? Meeting and participant details; calendar and meeting-integration data; meeting audio and captions; transcripts, summaries and decisions; action items with owners, due dates and completion status; Ask Loopion questions and generated answers; account/workspace information (name, business contact details, authentication identifiers); billing and subscription information.
Does the app support TLS 1.2 or higher? Yes
Does the app or underlying infrastructure store any Microsoft customer data? Yes
What data is stored in your databases? Action items, owners, due dates and completion status (retained indefinitely); meeting summaries and decisions; raw transcripts (retained per workspace-configurable retention setting: 0/30/90/180/365 days or indefinite, default 90 days); account, workspace and team-membership records; billing and subscription records (retained 6 years for UK tax purposes).
If underlying infastructure processes or stores Microsoft customer data, where is this data geographically stored? United Kingdom of Great Britain and Northern Ireland (the)
Do you have an established data rentention and disposal process? Yes
How long is data retained after account termination? More than 90days
Do you have an established data access management process? Yes
Do you transfer customer data or customer content to third parties or sub-processors? Yes
Do you have data sharing agreements in place with any third party service you share Microsoft customer data with? Yes

Questions

Questions or updates to any of the information you see here? Contact us!

This information has been provided by Loopion about the security practices this app employs.

Information Response
Do you perform annual penetration testing on the app? No
Does the app have a documented disaster recovery plan, including a backup and restore strategy? Yes
Does your environment use traditional anti-malware protection or application controls? ApplicationControls
Do you have an established process for indentifying and risk ranking security vulnerabilities? Yes
Do you have a policy that governs your service level agreement (SLA) for applying patches? Yes
Do you carry out patch management activities according to your patching policy SLAs? Yes
Does your enviroment have any unsupported operating systems or software? No
Do you conduct quarterly vulnerability scanning on your app and the infastructure that supports it? Yes
Do you have a firewall installed on your external network boundary? Yes
Do you have an established change management process used to review and approve change requests before they are deployed to production? No
Is an additional person reviewing and approving all code change requests submitted to production by the original developer? No
Do secure coding practices take into account common vulnerability classes such as OWASP Top 10? Yes
Multifactor Authentication (MFA) enabled for: CodeRepositories, Credential, DNSManagement
Do you have an established process for provisioning, modification, and deletion of employee accounts? Yes
Do you have Intrusion Detection and Prevention (IDPS) software deployed at the perimeter of the network boundary supporting your app? N/A
Do you have event logging set up on all system components supporting your app? Yes
Are all logs reviewed on a regular cadence by human or automated tooling to detect potential security events? Yes
When a security event is detected are alerts automatically sent to an employee for triage? Yes
Do you have a formal information security risk management process established? Yes
Do you have a formal security incident response process documented and established? Yes
Do you report app or service data breaches to supervisory authorities and individuals affected by the breach within 72 hours of detection? Yes

Questions

Questions or updates to any of the information you see here? Contact us!

This information has been provided by Loopion regarding the compliance standards their app requires and the certifications they have achieved.

Information Response
Does the app comply with the Health Insurance Portability and Accounting Act (HIPAA)? N/A
Does the app comply with Health Information Trust Alliance, Common Security Framework (HITRUST CSF)? N/A
Has the organization achieved a Service Organization Controls (SOC 1) Certification? N/A
Has the organization achieved a Service Organization Controls (SOC 2) Certification? No
Has the organization achieved a Service Organization Controls (SOC 3) Certification? No
Do you carry out annual PCI DSS assessments against the app and its supporting environment? N/A
Is the app International Organization for Standardization (ISO 27001) certified? No
Does the app comply with International Organization for Standardization (ISO 27018)? No
Does the app comply with International Organization for Standardization (ISO 27017)? N/A
Does the app comply with International Organization for Standardization (ISO 27002)? N/A
Is the app Federal Risk and Authorization Management Program (FedRAMP) compliant? No
Does the app comply with Family Educational Rights and Privacy Act (FERPA)? N/A
Does the app comply with Children's Online Privacy Protection Act (COPPA)? N/A
Does the app comply with Sarbanes-Oxley Act (SOX)? N/A
Does the app comply with NIST 800-171? N/A
Has the app been Cloud Security Alliance (CSA Star) certified? No

Questions

Questions or updates to any of the information you see here? Contact us!

This information has been provided by Loopion about the privacy posture of their app.

Information Response
Do you have GDPR or other privacy or data protection requirements or obligations (such as CCPA)? Yes
Does the app have an external-facing privacy notice that describes how it collects, uses, shares, and stores customer data? Yes
Privacy Policy URL https://loopion.ai/privacy-policy
Does the app perform automated decision making, including profiling that could have a legal effect or similar impact? No
Does the app process customer data for a secondary purpose not described in the privacy notice (i.e. marketing, analytics)? No
Do you process special categories of sensitive data (i.e. racial or ethnic origin, political opinion, religious or philosophical beliefs, genetic or biometric data, health data) or categories of data subject to breach notification laws? No
Does the app collect or process data from minors (i.e., individuals under the age of 16)? No
Does the app have capabilities to delete an individual's personal data upon request? Yes
Does the app have capabilities to restrict or limit the processing of an individual's personal data upon request? Yes
Does the app provide individuals the ability to correct or update their personal data? Yes
Are regular data security and privacy reviews performed (for example, Data Protection Impact Assessments or privacy risk assessments) to identify risks related to the processing of personal data for the app? Yes

Questions

Questions or updates to any of the information you see here? Contact us!

Information Response
Does your application integrate with Microsoft identity platform (Microsoft Entra ID) for single-sign on, API access, etc.? Yes
Have you reviewed and complied with all applicable best practices outlined in the Microsoft identity platform integration checklist? Yes
Does your app use the latest version of MSAL (Microsoft Authentication Library) or Microsoft Identity Web for authentication? No
Does your app support Conditional Access policies? Yes
If your app does not use one of the above libraries, what authentication library or libraries does it use? Delegated sign-in uses NextAuth v4: the standards-compliant OIDC authorization code flow with PKCE and state against the Microsoft identity platform v2.0 endpoints. Tokens are validated with the jose library against the tenant JWKS for signature, issuer, audience and expiry. App-only Graph access uses @azure/identity ClientSecretCredential, which wraps MSAL Node 5.5.0, the current release.
List the types of policies supported Users sign in through the Microsoft identity platform v2.0 authorization code flow with PKCE, so Conditional Access is evaluated by Entra ID at token issuance and inherited in full: multifactor authentication, device compliance and Intune management state, trusted location and named network rules, sign-in and user risk policies, session controls including sign-in frequency, and app enforced restrictions. Loopion does not bypass or cache around any of these.
Does your app support Continuous Access Evaluation (CAE) No
Does your app store any credentials in code? No
Apps and add-ins for Microsoft 365 might use additional Microsoft APIs outside of Microsoft Graph. Does your app or add-in use additional Microsoft APIs? Yes

Data access using Microsoft Graph

Graph Permission Permission Type Justification Microsoft Entra App ID
Calendars.Read delegated A user connects their own work calendar so Loopion can detect their upcoming meetings and schedule the recording assistant to join them. Loopion reads only that user's own calendar view: event start and end time, subject, organiser, attendees and the Teams join URL. It never creates, edits or deletes calendar events, and it does not read any other user's calendar. 431565fd-5dc0-49f8-bb6b-09acec7624dc
User.Read delegated Used to identify which account the connected calendar belongs to. After consent Loopion reads the account's id, mail and userPrincipalName so the calendar connection is bound to the correct person and the correct Loopion workspace, and so the user can see which account is connected and disconnect it themselves. 431565fd-5dc0-49f8-bb6b-09acec7624dc
User.Read delegated Used to complete Teams single sign-on. When a user opens the Loopion tab or interacts with the bot, the Teams client issues a token that Loopion validates and exchanges for an application session. User.Read supplies the signed-in user's identifier, display name and email so Loopion can match them to their workspace membership and apply role-based access. No directory, mailbox or calendar data is read with this permission. 8e93f13f-6c39-4053-890c-ba270e60cce8
Calendars.Read application Loopion operates its own assistant mailbox. Customers invite that mailbox to a meeting exactly as they would any other attendee. Loopion reads the assistant mailbox's own calendar, and subscribes to its change notifications, to learn which meetings it has been invited to and when to join. This reads Loopion's own mailbox, not a customer's. a87a340c-dacd-4979-87d6-eeac2b76a863
Calendars.ReadWrite application Used to create the Teams meeting for an Enterprise demo booked from the loopion.ai website. When a prospect submits the demo form, Loopion creates a calendar event in our own sales organiser's mailbox and invites the prospect. Writes are confined to Loopion-owned mailboxes; this permission is never used to modify a customer's calendar. a87a340c-dacd-4979-87d6-eeac2b76a863
Directory.Read.All application Used to read Loopion's own tenant licence position for our internal cost dashboard: subscribedSkus and directory subscriptions, so we can report how many Microsoft 365 seats we hold, how many are assigned, and when the subscription renews. It reads only our own single tenant's subscription data. No customer directory, user or group data is accessed. a87a340c-dacd-4979-87d6-eeac2b76a863
Mail.Read application Microsoft Graph provides no delivery webhook for sendMail, so Loopion reads the inbox of its own no-reply mailbox to find non-delivery reports and mark the matching message as bounced in our send log. This stops us repeatedly emailing dead addresses. Only Loopion's own sending mailbox is read; no customer mailbox is ever accessed. a87a340c-dacd-4979-87d6-eeac2b76a863
Mail.Send application Used to send Loopion's transactional email - meeting recaps, capture-ready notifications, workspace invitations, billing receipts and security alerts - from a single dedicated no-reply mailbox that Loopion owns. Mail is sent only from that mailbox, and only to addresses belonging to the workspace the message concerns. a87a340c-dacd-4979-87d6-eeac2b76a863

This application does not have Additional APIs.

Questions

Questions or updates to any of the information you see here? Contact us!

  • Last updated on