Built to be trusted with your roadmap
Lookouts only watches. It reads the projects you connect, stores the minimum it needs, and never changes anything in your tools. Here is exactly how.
What each connection can do
The exact access Lookouts asks for. Nothing more.
Data we hold
Only what alerts need
Issue keys, titles, status, assignee, dates, priority and blocked-by links, plus pull request state. Issue descriptions and code are never stored. Comments are only checked for a mention of you.
No training on your data
Your project data is never used to train AI models. AI drafts are generated only when you ask, from the data you can already see in Lookouts.
How it's protected
Encrypted tokens
OAuth tokens are encrypted at rest with AES-256-GCM. The key lives in the hosting platform's encrypted environment, never in the database.
Encrypted in transit
Everything is served over HTTPS with HSTS. In production the database connection is TLS-encrypted and verifies the server's certificate.
Verified webhooks
Incoming requests from Linear, GitHub, Slack and our billing provider are checked against an HMAC signature. Jira webhooks carry a secret token that is unique to each connection.
Secure sign-in
Passwords are salted and hashed, never stored. Sessions use HttpOnly, SameSite cookies that are marked Secure over HTTPS. Sign-up requires a work email or work Google account.
Workspace isolation
Every request is checked against your workspace, so one customer's data is never returned to another.
Browser hardening
Security headers block clickjacking and content sniffing and limit what referrer information leaves the page.
Your control
Disconnect anytime
Disconnecting a tool deletes everything synced from it and removes any webhook we registered. You can also revoke access from inside Linear, Jira, GitHub or Slack.
Delete your account
Deleting your account from Settings removes your workspace, connections and synced data. Short-lived technical records are cleared automatically within about 60 days.
Email choices
Product tips and trial reminders can be switched off in Settings or with the unsubscribe link in each email.
How we work
Tested on every change
Each change runs type-checking, automated tests and a full build before it ships.
Minimal providers
A small set of service providers handle hosting, email, AI drafts, Slack delivery and payments. They are listed in our Privacy Policy.
What we don't have yet
We would rather tell you than let you assume.
- A SOC 2 or ISO 27001 audit report. We haven't been through one yet.
- Single sign-on (SAML) and audit logs for teams.
- A public bug bounty. Reports are still welcome, see below.
Found a problem?
Email [email protected] with the details and how to reproduce it. We will acknowledge your report, keep you updated, and won't take action against anyone who reports in good faith and doesn't access other people's data or disrupt the service.
Last reviewed October 25, 2026. See also our Privacy Policy and Terms.