About Security

GoVyrl, Inc. (dba Carro) is committed to protecting your personal and company data. We continuously invest in the security of our platform to protect the confidentiality, integrity, and availability of your data.

Cloud Infrastructure

Carro's platform runs on Google Cloud Platform (GCP), and our primary database is MongoDB Atlas. Both run on provider-managed, multi-region infrastructure with built-in redundancy. Backups of our primary database are kept for up to 12 months. The physical security of the data centers is managed by these providers. Information about each provider's security and compliance programs is available at Google Cloud Compliance and the MongoDB Trust Center.

Data Encryption

Data in transit: all data is encrypted in transit using Transport Layer Security (TLS) 1.2 or higher.

Data at rest: data stored in MongoDB Atlas and Google Cloud Platform is encrypted at rest using AES-256 encryption. Account credentials are stored using industry-standard one-way hashing and are never stored in plaintext.

Access Control

Access to customer data is limited to authorized personnel on a least-privilege basis. Multi-factor authentication is required for our company accounts and for all administrative access. Administrative access to our infrastructure is authenticated through dedicated credentialing and secrets-management systems. Access is removed promptly when someone leaves the company.

Security Testing

Our platform is regularly tested by an independent security firm through penetration testing, and findings are remediated based on their severity.

Monitoring and Logging

We maintain audit logging of authenticated platform activity and application-level logging across our infrastructure to support security monitoring and incident investigation.

Our Team

All employees have a background check when they join, to the extent permitted by local law. Everyone working at Carro completes security and privacy training when they join and every year after that. Computers used for Carro work are monitored for disk encryption, screen lock, firewall, and anti-malware protection.

Security Policies and Incident Response

Our security program is defined by a set of written policies, including incident response, access control, and data management. We maintain a process for detecting, investigating, and responding to security incidents, and we notify affected Retailers as described in our Retailer Data Processing Addendum.

Sub-processors and Compliance Documentation

Our current list of sub-processors and our security documentation are available on our Trust Center.

Privacy

We are committed to protecting your personal and company information. Our Privacy Policy describes how we handle your data, and our Retailer Data Processing Addendum and Supplier Data Processing Addendum set out our data protection commitments. For questions about privacy, including your CCPA or GDPR compliance efforts, contact us at privacy@getcarro.com.

Reporting a Security Issue

If you believe you have found a security vulnerability or have a security question, please email security@getcarro.com. We review every report and will follow up with you.