About Security
Last updated
GoVyrl, Inc. (dba Carro) is committed to protecting your personal and company data. We continuously invest in the security of our platform to protect the confidentiality, integrity, and availability of your data.
Cloud Infrastructure
Carro’s platform runs on Google Cloud Platform (GCP), and our primary database is MongoDB Atlas. Both run on provider-managed, multi-region infrastructure with built-in redundancy. Information about each provider’s security and compliance programs is available at Google Cloud Compliance and the MongoDB Trust Center.
Data Encryption
Data in transit: all data is encrypted in transit using Transport Layer Security (TLS) 1.2 or higher.
Data at rest: data stored in MongoDB Atlas and Google Cloud Platform is encrypted at rest using AES-256 encryption. Account credentials are stored using industry-standard one-way hashing and are never stored in plaintext.
Access Control
Access to customer data is limited to authorized personnel on a least-privilege basis. Administrative access to our infrastructure is authenticated through dedicated credentialing and secrets-management systems.
Monitoring and Logging
We maintain audit logging of authenticated platform activity and application-level logging across our infrastructure to support security monitoring and incident investigation.
Incident Response
We maintain a process for detecting, investigating, and responding to security incidents, and we notify affected Retailers as described in our Retailer Data Processing Addendum.
Sub-processors and Compliance Documentation
Our current list of sub-processors and our security documentation are available on our Trust Center.
Privacy
We are committed to protecting your personal and company information. Our Privacy Policy describes how we handle your data, and our Retailer Data Processing Addendum and Supplier Data Processing Addendum set out our data protection commitments. For questions about privacy, including your CCPA or GDPR compliance efforts, contact us at privacy@getcarro.com.
To report a security issue or ask about security matters, email security@getcarro.com.