Security & Trust

We would rather tell you this now than have you find out during procurement. If a pending certification is a hard blocker on your side, say so early — it changes what we can commit to on a timeline.

Tenant data isolation

Every tenant-scoped table enforces PostgreSQL Row-Level Security, keyed on the authenticated organisation, in addition to filtering in application code. A request authenticated as one organisation cannot read or write another organisation's rows, even if the application layer had a bug — the database itself refuses the query. This is verified by an automated test on every change to the codebase, not just asserted in this document.

Encryption

• In transit: TLS 1.2+ on all API and dashboard traffic.
• At rest: provider-managed encryption on the database and object storage.
• Third-party credentials: stored integration secrets (e.g. a Slack bot token) are Fernet-encrypted before they touch the database, not stored as plaintext with access control as the only protection.

Sub-processors

• AWS — compute, database, and object storage. Region: ap-south-1.
• OpenAI — LLM calls made on your behalf where you configure Cartha to make them.

Data retention

Deleting an organisation purges every row it owns within the same request; backups purge within 30 days of primary deletion. See our Privacy Policy for the full data-category breakdown.

Audit evidence

Policy decisions (with deny reasons), human approvals (with resolver and timestamp), budget spend, and memory operations are recorded and exportable:

• GET /api/v1/org/audit-pack — the compliance evidence bundle (Assure, or the audit-pack add-on on Control).
• GET /api/v1/org/export — full data export, available on every plan.

Reporting a security issue

Email hello@cartha.in with details. We triage security reports within one business day.