LociLab
Environment access
Email-code sign-in and server-side sessions. Environments are scoped to their owners, with explicit organization sharing. Viewers can read shared records; editing requires an appropriate role.
TRUST & DATA / UPDATED SEPTEMBER 30, 2026
Clear boundaries.
Traceable records.
This page describes the current product and its data flows. LociLab is an early-access product of Chimes In LLC.
This deployment has not been approved for classified information, controlled government data or export-controlled technical material. No SOC 2, ISO 27001, FedRAMP or CMMC status is claimed. A provider’s certifications do not certify LociLab.
ACCESS & CONTROL
Implemented product controls.
Scoped integrations
Integration credentials are handled on the server. Camera connector tokens are scoped to one zone, expire and can be revoked. External record delivery uses configured, reviewed workflows.
Reviewable provenance
Observation histories, correction records and review histories preserve context. Selected files and report snapshots include hashes. A hash can check integrity; it does not prove an interpretation is correct.
DATA FLOW
What leaves the application, and why.
Cloudflare
Hosts the application. D1 stores accounts, records and settings; R2 stores files and previews; Vectorize supports retrieval of indexed records. Operational logs support troubleshooting. A customer-selected residency region is not offered in this deployment.
OpenAI
Requested AI analysis sends selected images and relevant record context. Saved text may also be processed in background embedding jobs to support search; questions can be embedded during retrieval. Reasoning requests set store:false, which is not a promise of zero retention across every provider system.
Meta
Object-selection requests can send the selected image and prompt to the configured Meta API. Segmentation output is model-generated evidence to review, not verified object identity.
Resend
Receives the email address and sign-in message needed to deliver an access code.
Element 84 / Sentinel imagery
A requested satellite search sends area bounds, dates and cloud filters to Earth Search. Selected scene metadata and available previews are retrieved from the catalog and Sentinel object storage. Saving an area alone does not request imagery.
Customer-configured destinations
Reviewed webhook or ServiceNow deliveries send the selected payload to the configured destination. Review its contents and your organization’s permissions before delivery. Provider terms, processing locations and retention depend on the applicable service and account configuration.
RETENTION & PORTABILITY
Export and deletion have different scopes.
What can I export?
Environment exports contain structured records. Original files are downloaded separately through authenticated links. Satellite scenes include source metadata and stored overview downloads. Reviewed inspection reports provide report and manifest exports.
What does deleting a file do?
Evidence-file deletion removes the stored original and associated preview; satellite preview deletion removes that JPEG. Source records, observations, hashes and review history can remain. This is not complete account erasure, and previously downloaded or externally delivered copies are not recalled.
Are records automatically removed after a fixed period?
A customer-configurable retention policy and automated full account-erasure workflow are not available. Contact Chimes In LLC to discuss a data request; scope and identity verification must be established before action. No fixed deletion or backup-purge deadline is promised here.
Are private records available offline?
The service worker caches a minimal offline page and app icon, not private API responses or uploaded evidence. Files deliberately downloaded to your device remain under your control.
ENTERPRISE READINESS
Evaluate before procurement.
SSO/MFA administration, contractual service levels, customer-managed keys, regional residency commitments, a customer DPA, independent security assessment, documented recovery testing and configurable retention require further work or validation. Do not infer these from the interface or the hosting provider.
Government requirements depend on the data and procurement. Confirm the required system boundary and assessment with the customer before selecting a production deployment.
Official FedRAMP marketplace →CONTACT
Questions about data or security?
Contact Chimes In LLC at +1 904-807-7804. Please arrange an appropriate channel before sharing sensitive records or security details.
This is a factual product and data-handling overview. Customer agreements and a complete jurisdiction-specific privacy notice require separate review.
ORGANIZATION PROCESSING CONTROLS
Choose which AI processing is allowed.
Organization owners and administrators can independently block AI reasoning, semantic-search embeddings (including background indexing), and Meta image processing under Teams & integrations → Data controls. These settings apply to environments currently shared with that organization. Personal environments outside the organization retain their existing processing behavior.
Existing settings remain enabled until changed. Blocking a provider purpose prevents new eligible processing requests; already dispatched requests cannot be recalled. Disabling embeddings pauses pending indexing and semantic search. Re-enabling it resumes eligible queued records.
This does not erase prior provider submissions, stored vectors, or reports, disable outbound integrations, change Cloudflare storage, or establish residency or government compliance. Policy changes are versioned and logged.