Serious where it counts.
Bloops touch receipts, contracts, statements — the documents you can't afford to be careless with. So the careful part isn't an afterthought. Here's exactly how your data is handled.
One job, done right
Each bloop does a single thing — not a general assistant half-doing ten. Narrow scope means a narrow blast radius, and a result you can actually reason about.
Output you can verify
Extractions come back as tables you can check and correct, uncertain fields flagged and linked to their source. Nothing leaves until you say so.
Your data stays yours
Scoped, read-only access to only what you pick. Encrypted at rest, never used to train anything, and destroyable on request.
Built to clear a security review
The specifics your security team will ask about — answered up front.
⚿ Encryption at rest
Sensitive fields are encrypted with AES-256-GCM under a per-tenant key, a fresh random IV for every record, and an authentication tag verified on read. One tenant's key never touches another tenant's data.
◱ Provable tenant isolation
Every database read and write is scoped to your tenant at a single choke point — a route can't physically query another tenant's data by forgetting a filter. It's enforced by the architecture, not by convention, and covered by tests in CI.
◎ Least-privilege connectors
When a bloop reads from a connected source like Google Drive, it defaults to the narrowest read scope, only the files you pick through a policy-gated picker, and always read-only. Content is redacted and audited before it ever reaches a prompt.
✎ Never used for training
Your inputs and outputs are used to do your job and nothing else. They're never used to train models — ours or anyone else's.
⌫ Deletion you can prove
Ask for deletion and the per-tenant key is destroyed — crypto-shred makes the ciphertext unrecoverable, not merely flagged as gone. Retention windows are enforced automatically.
⊟ Access, scoped & audited
SSO and SCIM for provisioning, role-based access for who can run and edit, and an audit trail on privileged and connector actions. Access is scoped and revocable.
You never have to take a result on faith
Every extracted value carries a confidence and links back to the exact source line it came from — the statement row, the clause, the receipt. The bloop marks its own doubts, so a quick glance is all a result needs before it becomes yours.
See the verification surface →Read it in full
The commitments above are written out where they're binding. No dark patterns, no buried clauses.
Last updated August 2026 · Questions? trust@bloops.studio
Careful with the
important stuff.
Give a bloop one thing to do — and trust how it's handled while it does it.