Security & Trust
Last reviewed: 15 August 2026
What follows is what is actually true today, not a roadmap. Where something is in progress we say so. A machine-readable version of this page is available at GET /api/v1/trust for vendor-risk questionnaires.
Certifications
Cartha holds no certification today. Our controls are mapped to SOC 2, not audited. The plan is an independent penetration test first, then SOC 2 Type I and Type II. If a certification is a hard blocker for you, tell us early, because it changes what we can commit to on a timeline.
Tenant data isolation
Every tenant-scoped table enforces PostgreSQL Row-Level Security, keyed on the authenticated organisation, in addition to filtering in application code. A request authenticated as one organisation cannot read or write another organisation's rows, even if the application layer had a bug — the database itself refuses the query. This is verified by an automated test on every change to the codebase, not just asserted in this document.
Encryption
- In transit: TLS 1.2+ on all API and dashboard traffic.
- At rest: provider-managed encryption on the database and object storage.
- Third-party credentials: stored integration secrets (e.g. a Slack bot token) are Fernet-encrypted before they touch the database, not stored as plaintext with access control as the only protection.
Sub-processors
- AWS: compute, database, storage and key management. Region: ap-south-1 (Mumbai).
- The model providers you choose (for example OpenAI, Anthropic, Google): Cartha forwards your governed calls to them, and asks the same provider, on your key, to judge plain-language rules.
Data retention
| Plan | Trace & memory retention |
|---|---|
| Trace | 30 days |
| Control | 90 days |
| Assure | Custom, contracted per deployment |
Deleting an organisation purges every row it owns within the same request; backups purge within 30 days of primary deletion. See our Privacy Policy for the full data-category breakdown.
Audit evidence
Policy decisions (with deny reasons), human approvals (with resolver and timestamp), budget spend, and memory operations are recorded and exportable:
GET /api/v1/org/audit-pack— the compliance evidence bundle (Assure, or the audit-pack add-on on Control).GET /api/v1/org/export— full data export, available on every plan.
Reporting a security issue
Email hello@cartha.in with details. We triage security reports within one business day.