# Privacy, Security, Data Governance, & Compliance: Loamist

> Loamist cybersecurity whitepaper covering privacy, security infrastructure, data governance, compliance certifications, and AI processing practices.

Source: https://www.loamist.com/cybersecurity-whitepaper.html

Cybersecurity whitepaper Version 2.0 | February 2026

# Privacy, security, data governance, & compliance

AI-powered supply chain validation with privacy-first design.

## Introduction

Loamist Validator™ is an AI-powered platform that processes trade documentation and validates supply chain compliance for regulated industries. We integrate with Google's Gemini large language models (LLMs) to automate document processing while maintaining enterprise-grade security and privacy.

This whitepaper explains how we handle your data, our security practices, and our approach to building AI tools for regulated supply chains.

## Core commitments

### Your data is your data

**We process your data only according to your instructions.** When you upload trade documents, compliance certificates, or supply chain data to Loamist:

- **Your data remains your data**: You control it, you own it, and you can delete it at any time
- **Your data never trains our models**: We do not use your documents to improve our systems or train AI models
- **Your data stays within your account**: Documents are never shared across organizations
- **Delete anytime**: Remove documents via the interface or on request; upon account closure, all data deleted within 30 days

### What we will not do

- **We will never sell your data**: Your documents and extracted data are never sold or monetized
- **We will never train models on your data**: AI processing does not feed back into model training
- **We will never share data across customers**: Complete isolation between organizations
- **We will never use your data for advertising**: No ads, no tracking, no secondary use

### Enterprise-grade security and privacy

- **Encryption everywhere**: TLS 1.3 in transit, AES-256 at rest
- **Complete audit trails**: Immutable logs of every action, every user, every document
- **Access controls**: Role-based permissions with SSO support
- **Certifications**: SOC 2 Type II certified

## Privacy principles in detail

### Your data is your data

**Customer data belongs to you and only you.** When you upload documents to Loamist:

- Documents are processed using Google's Gemini models via their API: Google does not use Enterprise API customer data to train their models
- Your data stays within your account and is not shared across organizations
- You maintain complete control over retention and deletion

### Encryption and security

**All data is encrypted at all times:**

- **In transit**: TLS 1.3 encryption
- **At rest**: AES-256 encryption
- **During processing**: Documents remain encrypted throughout the validation pipeline

**Access control:**

- Role-based permissions control who can upload, review, and approve documents
- Single Sign-On (SSO) support for Google Workspace (Microsoft Azure AD and SAML in roadmap for 2026)
- All access logged with user attribution and timestamps

### Data retention

**Your data is retained while your account is active:**

- Delete documents at any time via the Loamist interface or on request
- Upon account closure: all customer data deleted within 30 days

**Audit logs retained for 7 years** to support regulatory audits: these are immutable records of every processing event, user access, and validation decision.

## Security infrastructure

### Cloud infrastructure on AWS

**Enterprise-grade cloud security with multiple layers of protection:**

- **Web Application Firewall (WAF)**: Protection against common web exploits
- **DDoS protection**: AWS Shield for network and transport layer protection
- **Network isolation**: VPC segmentation with private subnets for sensitive components
- **Infrastructure monitoring**: CloudWatch for real-time monitoring and alerting
- **Compliance foundation**: AWS maintains SOC 2, ISO 27001, GDPR, HIPAA, and FedRAMP certifications

### AI processing via Google Gemini API

**Secure API integration with Google's enterprise AI:**

- Document processing leverages Google's Gemini models via secure API calls
- Google's enterprise commitment: API customer data is not used to train models
- Benefits from Google's AI security infrastructure (prompt injection defenses, adversarial testing)

### Application security practices

**Secure development and operations:**

- Regular security updates and patch management
- Secure development lifecycle with code reviews
- Dependency scanning for vulnerabilities
- Automated security testing in CI/CD pipeline

**Authentication and access:**

- Single Sign-On (SSO) support for Google Workspace (Microsoft Azure AD and SAML in roadmap for 2026)
- Session management with automatic timeout

**Monitoring and alerting:**

- Continuous monitoring for suspicious activity
- Automated alerts for failed authentication, unusual access patterns, or system anomalies
- Integration with customer SIEM systems available

## Compliance and certifications

### Security certifications

**SOC 2 Type II** (Certified)

- Independent audit of security, availability, and confidentiality controls complete
- Controls monitored continuously in Vanta (our compliance monitoring platform)
- Validates responsible customer data management

### Industry-specific compliance support

**Trade Finance and Letters of Credit:**

- UCP 600 (Uniform Customs and Practice for Documentary Credits): ICC Publication No. 600, governing international letters of credit across 175+ countries
- Strict compliance verification for letter of credit terms
- Commercial invoice validation (description accuracy, amount verification)
- Transport document verification (bills of lading, cleanliness requirements, signature validation)
- ISBP 745 (International Standard Banking Practice): companion guide for document examination

### How Loamist supports compliance

- Automated extraction of required data fields with strict compliance verification for letter of credit transactions
- Geospatial validation for location-dependent compliance requirements
- Document consistency checking across related documents (invoices, bills of lading, certificates) per UCP 600 Article 14(d)
- Chain-of-custody audit trails for regulatory claims and certifications
- Flagging of common discrepancies in documentation (invoice amounts, transport document issues, missing signatures)
- Compliance reports with supporting documentation

## Deployment options

### Current: cloud deployment on AWS

**Cloud-based SaaS platform in US regions:**

- Load balancing across multiple availability zones within a region
- Currently deployed in US AWS regions
- Regional data residency options (including EU) planned for future expansion
- AWS security features: WAF, Shield DDoS protection, VPC isolation
- 99.9% uptime target
- Automatic scaling

### Future: on-premises and air-gapped options

**Aligned with Google's infrastructure roadmap:**

Google is expanding Gemini availability to on-premises environments via **Google Distributed Cloud (GDC)**, enabling customers to run Gemini models entirely within their own data centers, including air-gapped environments for classified workloads.

**Loamist's intent**: As Google makes these capabilities available, we plan to offer on-premises deployment options for customers with strict data residency requirements:

- **On-premises**: Run Loamist Validator™ in your data center with GDC infrastructure
- **Air-gapped**: Complete network isolation for sensitive environments
- **Hybrid**: Process sensitive documents on-premises, leverage cloud for other workloads

**Timeline**: Following Google's GDC roadmap (2025 and beyond)

**Why this matters**: Customers in regulated industries (government, defense, critical infrastructure, financial services) will be able to use Loamist's AI capabilities without data leaving their premises.

## Data governance

### All customer data is confidential

**No data classification tiers: everything is treated as confidential and restricted:**

- Only users within your organization can access your documents
- No cross-organization data sharing
- No external use for training, advertising, or other purposes
- Encryption applied uniformly to all data

### Audit and transparency

**Chain-of-custody logging:**

- Every document upload, processing event, and user action is logged
- Logs include timestamps, user IDs, document IDs, and validation decisions
- Immutable audit trail for regulatory compliance (cannot be altered after creation)

**Confidence scoring:**

- AI extractions include confidence scores (0-100%) for each data field
- Low-confidence extractions flagged for human review
- Complete visibility into what AI extracted and its certainty level

**Data access and portability:**

- Export all data at any time (documents, extracted data, audit logs)
- Standard formats: JSON, CSV, PDF reports
- No lock-in: you own your data

## Human review and validation

**AI automation with human oversight for compliance decisions:**

### Confidence thresholds

- **High confidence (>90%)**: Automatic approval for standard documents
- **Medium confidence (70-90%)**: Flagged for human review
- **Low confidence (

**Website**: [www.loamist.com](https://www.loamist.com)

**Support**: [support@loamist.com](mailto:support@loamist.com)

## Summary

**Loamist provides AI-powered supply chain validation for regulated industries with privacy and security built in from day one.**

### Core commitments

- **Your data is your data**: You control it, you own it, and you can delete it at any time
- **Your data never trains our models**: No model training, no secondary use, no data sharing across customers
- **Enterprise-grade security**: Encryption everywhere (TLS 1.3, AES-256), complete audit trails, SOC 2 Type II certified
- **Compliance-focused**: Purpose-built for international trade finance, sustainable materials, and regulated supply chains
- **Transparent AI**: Confidence scoring and human review for all validation decisions
- **Deployment flexibility**: Cloud today, on-premises options planned as Google enables them

### What we will not do

- We will never sell your data
- We will never train models on your data
- We will never share data across customers
- We will never use your data for advertising

We're building Loamist with security, privacy, and compliance as foundational principles. As we grow, we're committed to maintaining these standards while expanding our capabilities to serve regulated supply chains worldwide.

Contents

- [Introduction](#introduction)
- [Core commitments](#core-commitments)
- [Privacy principles in detail](#privacy-principles-in-detail)
- [Security infrastructure](#security-infrastructure)
- [Compliance and certifications](#compliance-and-certifications)
- [Deployment options](#deployment-options)
- [Data governance](#data-governance)
- [Human review and validation](#human-review-and-validation)
- [Business continuity](#business-continuity)
- [Frequently asked questions](#frequently-asked-questions)
- [Contact us](#contact-us)
- [Summary](#summary)