Security
You're trusting us with your customer list. Here's how we look after it.
Who we are, where your data lives, who can see it, and what happens to it when you leave.
Where your data lives
Your data is stored in the European Union (Frankfurt, Germany) on Supabase, a managed Postgres platform. The database is backed up daily by our provider.
Every workspace is isolated
Each workspace is separated with row-level security in the database itself, on every table. An automated test suite tries to read and change other workspaces' data for every table, and must fail every time before a change ships.
Encryption
All traffic uses TLS. Data is encrypted at rest (AES-256) in the database and in file storage. Profile photos sit in private storage and are shown through short-lived signed links.
Access control
Role-based permissions (Admin and Member) inside each workspace. Passwords are stored only as salted hashes. API keys for the capture endpoint are stored as hashes, rate limited and can be restricted to your own websites.
AI and your data
The Revenue Assistant uses Anthropic's models. It only sees the records the person asking is allowed to see, and only what is needed for that request. Your data is not used to train AI models, by us or by Anthropic. The assistant never changes records or sends messages without approval.
Export and deletion
You can ask for a full export of your data at any time. When you leave, you have 30 days to take your data; after that we delete it within 30 days, and from backups as they rotate.
Compliance
- GDPR. We act as your processor for customer data, under our Data Processing Agreement. The list of providers we rely on is on our Subprocessors page.
- SOC 2 and ISO 27001. Carpuse itself is not certified yet. Our infrastructure providers (Supabase, Vercel) hold SOC 2 Type 2 reports, and payments are handled by Paddle, which is PCI DSS Level 1 compliant. We're happy to complete your security questionnaire.
- Card data. Carpuse never sees or stores card numbers; Paddle handles all payments.
Report a security issue
Found a vulnerability? Please email us before disclosing it publicly. We reply within 2 business days and keep you updated until it's fixed. For security questionnaires, use the same address.
hi@carpuse.com