Loom and GDPR: What EU Agencies Should Check

Loom can be used under GDPR, but you have to check a few documents and settings yourself. Atlassian, which owns Loom, applies its Data Processing Addendum (DPA) automatically and has offered EU data residency for new workspaces since May 2026, but some processing (transcription, AI features, account data) involves providers and locations outside your chosen region. Every detail below comes from Atlassian’s own pages, checked in November 2026.

We make a screen recorder that competes with Loom, so we’ve kept this strictly to what Atlassian publishes, with links. Where Loom is the better fit, we say so.

The short answer

Question	What Atlassian says	Where
Is there a DPA?	✓ Applies automatically with the Atlassian Customer Agreement	Atlassian DPA
Atlassian’s role	Processor (or sub-processor) of your data	DPA, section 1.1
EU data residency?	~ Germany (Frankfurt) since May 2026, new workspaces only	Loom data residency
Can you switch region later?	✗ You need a new workspace; videos can’t be moved	Loom data residency
Transfers outside the EU	EU standard contractual clauses and the EU-U.S. Data Privacy Framework	DPA
Subprocessors	✓ Public list, with 30 days’ notice of new ones to subscribers	Sub-processors page, DPA section 4
Retention rules	~ Enterprise and Business + AI only, in Atlassian-managed workspaces	Loom data retention

From Atlassian's own pages, checked November 2026. Loom is a trademark of Atlassian.

Who is responsible for what

Atlassian’s DPA sets the roles: the customer is the controller of its data (or a processor acting for another controller), and Atlassian is a processor or sub-processor. Atlassian’s privacy policy says the same from the other side: it covers what Atlassian does as a controller, like account information, and doesn’t apply where Atlassian processes data on behalf of customers.

For an agency, that means two layers. Your agency is responsible for the videos you record, and if they contain your client’s data, you may be acting for your client. Loom, through Atlassian, processes the videos for you. We explain the controller and processor roles in plain terms in GDPR and client videos.

Where Loom stores your data

By default, Atlassian doesn’t guarantee a specific hosting location: its GDPR page says hosting is chosen to reduce latency and improve performance. Its subprocessor list shows the main hosting provider, Amazon Web Services, with locations in the EEA (Sweden, Ireland and Germany), the UK, Switzerland, the US and several other countries.

To pin data to a region you need data residency. For Loom, Atlassian’s support page says:

• Regions: Germany (Frankfurt) and United States (Oregon), launched in May 2026.
• In scope: videos, comments, transcripts, AI-generated content such as summaries and documents, workspace settings, editing artifacts and collaboration features are stored and processed in the chosen region.
• Processed globally: user authentication, session data, user settings and preferences, organization membership, audit logs (which store only IDs), and cross-workspace features such as notifications, history and watch later. Atlassian says it doesn’t export or process raw customer content outside the region for normal operation.
• Who can get it: new standalone Loom workspaces, new Teamwork Collection customers, and existing Jira or Confluence customers adding a new Loom workspace. Existing Loom deployments are listed as a “future release” and Loom Legacy customers as “post-migration”.
• Limits: the region is set when the workspace is created and can’t be changed. Content can’t be transferred between the European and US workspaces.

On plans: Atlassian’s general data residency page lists Loom among the products with Standard, Premium and Enterprise plans, while Loom’s pricing page uses different plan names (Starter, Business, Business + AI, Enterprise) and doesn’t mention data residency. If EU residency is a requirement, ask Atlassian sales which Loom plan you need before you buy.

The DPA

Atlassian’s DPA (effective 17 August 2026) is the contract that covers Loom’s processing of your data. The points worth knowing:

• No separate signature. Atlassian’s FAQ says the DPA applies automatically when your organization accepts the Atlassian Customer Agreement. Atlassian also says it can’t work from your organization’s own DPA template.
• Transfers. For data leaving Europe to a country without an adequacy decision, the EU standard contractual clauses are incorporated by reference, and both parties are deemed to have signed them. Atlassian also participates in the EU-U.S. Data Privacy Framework. A pre-signed copy of the SCCs is available if you want one on file.
• Subprocessors. Atlassian gives at least 30 days’ notice to subscribed customers before a new subprocessor starts processing your data, and you can object during that period.
• Deletion. After the agreement ends, Atlassian must delete your personal data, but may keep it where the law requires or under its standard backup and record retention policies, while still protecting it under the DPA.

Atlassian also publishes material to help customers with data transfer impact assessments, linked from the DPA page.

Subprocessors that touch Loom

Atlassian’s subprocessor list (effective 15 May 2026) names the providers for each product. For Loom it includes, among others:

Provider	What it does for Loom	Location listed
Amazon Web Services	Cloud hosting	EEA, UK, Switzerland, US and others
Speechmatics (Cantab Research Ltd)	Transcription	USA
OpenAI	Generative AI for Loom AI features	USA
Twilio Segment	Data analytics	USA
Zendesk, PartnerHero	Customer support	USA; Philippines, Romania, South Africa

Atlassian Sub-processors page, effective 15 May 2026, checked November 2026. Loom is a trademark of Atlassian.

The list changes over time, so check the live page rather than this table, and subscribe to the notifications if you rely on Loom.

AI features and transcription

This is where most of the questions are, because transcripts contain everything you said in the video.

Atlassian’s Loom AI page says:

• Transcription uses OpenAI’s GPT and Google’s Gemini models, open-source Whisper hosted by Atlassian, and the transcription provider Speechmatics. The page doesn’t say which one handles a given video.
• OpenAI receives transcript text to generate titles, summaries, chapters and documents. It doesn’t receive video or audio, and receives no transcript data when Loom AI isn’t used.
• Google Gemini receives video and audio to generate Action Plans for AI Agents.
• Retention and training: “Neither OpenAI nor any other LLM provider retains your inputs and outputs”, and they don’t use them to improve their services.
• Controls: admins of Business + AI and Enterprise workspaces can turn AI settings on or off for everyone; users can also set defaults or switch features off for a single video.

Transcripts are available on every Loom plan, including the free Starter plan. Two things to reconcile when you assess this: the data residency page says transcripts and AI content are stored and processed in your region, while the subprocessor list shows Speechmatics and OpenAI with US locations. Ask Atlassian how this works for an EU-resident workspace, and get the answer in writing. If where your voice goes is the main concern, we compare the two approaches in on-device vs cloud transcription.

Retention and deletion

GDPR asks you to keep personal data no longer than necessary. In Loom, automatic deletion is a data retention rule, and Atlassian’s page says:

• Retention rules are available on Enterprise and Business + AI plans, and only for Atlassian-managed workspaces (not workspaces still on the legacy Loom admin console).
• Admins can keep videos indefinitely or set a period in days or years, for the workspace or per space.
• The period counts from the creation date of the video.
• Deletion covers recordings, transcripts, AI summaries and comments, and it’s permanent. Up to 2,000 videos per workspace are deleted per day.

On the Starter and Business plans, then, videos stay until someone deletes them. That’s the permanent-library model we discuss in why expiring video links are safer.

Questions to ask of any video tool

The same checks apply to Loom, to JustRec, and to anything else your agency uses to send video to clients. Each answer is in a document the vendor should publish.

Question	Why it matters	Where to look
Is there a DPA for this product? Do I need to sign it?	GDPR Article 28 requires a contract with every processor	DPA or legal page
Is the vendor a processor for my videos? What does it do as a controller?	Decides who answers for what	DPA (roles), privacy policy
Where are videos, transcripts and comments stored? Can I choose the EU?	Hosting in the EU avoids a transfer for that step	Data residency or security docs
What is processed outside that region, and by whom?	Transcription and AI are often where data leaves	Subprocessor list
Am I told before a new subprocessor starts?	You may want to object, or tell your clients	Subprocessor list, DPA
Which mechanism covers data leaving the EU?	It goes in your record of processing	DPA (transfers)
Is my voice sent to a transcription or AI provider? Can I turn it off?	A transcript holds everything you said	AI or transcription docs
Is my content used to train models, by the vendor or its providers?	Your client’s data could end up in someone’s training set	AI docs, terms of service
How long are shared videos kept? Can they be deleted automatically?	Personal data should be kept no longer than necessary	Retention docs, plan comparison
What happens to my data when I cancel?	Deletion or return at the end is part of the processor contract	DPA (deletion)
Does the video page set cookies or track viewers?	Your client is the person being tracked	Cookie policy, the video page itself

Write the answers down: they belong in your record of processing activities, and your clients may ask for them.

When Loom is the better choice, and when it isn’t

Loom does a lot that a small recorder doesn’t: a team video library, comments, integrations with Jira, Confluence and Slack, AI summaries and documents, admin controls and an enterprise contract with a published DPA and subprocessor list. If your agency lives in Atlassian tools, those are real advantages.

It’s a weaker fit if you want videos to stay online only for as long as the client needs them, if you’d rather not have your voice transcribed by a third party, or if you’re on an existing workspace that can’t move to EU residency. Our JustRec vs Loom comparison puts the two side by side, and the Loom alternative for Mac page explains what we built differently.