Org Loom helps you work with Salesforce records on a canvas, prepare changes, and collaborate with teammates. Here’s how we handle your data along the way.
Our servers connect your browser to Salesforce and keep shared canvases up to date. Salesforce record data is processed temporarily during those activities, without being stored at rest on our servers. When you save a canvas, it is encrypted and stored in your Salesforce org.
What passes through Org Loom’s servers?
When you load records, Org Loom’s server retrieves them from Salesforce and sends them to your browser. When you upload changes, the server sends those changes back to Salesforce.
When people work together on a shared canvas, Org Loom also temporarily holds canvas information in server memory to keep everyone’s view up to date.
We process data without storing it at rest on our servers.
Where is my work saved?
When you save a canvas, it is encrypted and stored as a file in your Salesforce org. Information used to recall eligible upload changes is also stored there.
Your browser keeps temporary recovery data to help protect work in progress. Our Security and Data documentation explains these storage locations and when temporary data is cleared.
Org Loom separately stores account information needed to operate the service. “We don’t store your Salesforce records” does not mean we store no information about you; our Privacy Policy explains that distinction.
Does sharing give people extra access to Salesforce data?
Sharing a canvas does not bypass Salesforce permissions. Each person connects using their own Salesforce account, and Org Loom checks what that person is allowed to access before showing shared information.
You also choose what they can do on the canvas, such as viewing it, completing requests, or editing.
You sign in to Salesforce through Salesforce’s own sign-in process. You do not give Org Loom your Salesforce password.
When does Salesforce actually change?
Editing on a canvas prepares changes. Those changes reach Salesforce when you explicitly upload them.
You can review your work first. Upload Recall can help reverse eligible changes afterward.
What if I use AI?
Our ‘Generate with AI’ feature sends your prompt and the selected Salesforce object and field definitions to Anthropic. It does not automatically send existing canvas record values. If you include sensitive information in your prompt, that information is sent too.
If you connect an external AI client through MCP, information returned by the canvas tools can be shared with that client.
How can I check this for myself?
Our canvas core and managed-package source code are available for review. You can also try Org Loom in a Salesforce sandbox before connecting production data or work from the core code directly.
For more detail, see our Security and Data documentation and Privacy Policy. If you have questions about your organization’s requirements, contact security@orgloom.com. We’re happy to help you understand how your data is handled before you connect.