Security

Our Security Commitment

At CartonPilot, security is fundamental to everything we build. We understand that you trust us with your business data, and we take that responsibility seriously. Our platform is designed with security at its core, implementing industry best practices to protect your data at every layer.

We are an early-stage company and do not yet hold formal certifications such as SOC 2 or ISO 27001. This page describes the practices we actually have in place today, so you can make an informed decision.

All data transmitted to and from CartonPilot is protected using industry-standard encryption:

• In Transit: All web and API traffic is served exclusively over HTTPS (TLS 1.2+), protecting your data during transmission
• Passwords: User passwords are salted and hashed using bcrypt with appropriate work factors - we never store plain-text passwords
• API Keys: Generated with a cryptographically secure random generator and stored as SHA-256 hashes - the full key is shown once at creation and never stored in plain text. Transmitted only over TLS and revocable instantly from your dashboard
• Payment Data: Card numbers never touch our servers - all payment details are handled directly by Stripe

Your API keys are critical credentials that control access to your account:

• Unique Keys: Each API key is cryptographically generated using secure random number generators and stored hashed (SHA-256) at rest
• Granular Permissions: Configure per-key algorithm restrictions and usage limits
• Instant Revocation: Revoke compromised keys immediately from your dashboard
• Usage Tracking: Monitor all API key activity with detailed logging
• Rate Limiting: Built-in rate limiting protects against abuse and brute-force attacks

Our infrastructure is built on modern cloud platforms with enterprise-grade security:

• Cloud Hosting: Deployed on cloud infrastructure (AWS, US region) with regular operating-system patching
• Database Security: Credential-protected PostgreSQL, accessed by the application over authenticated connections
• Rate Limiting: Per-key and per-IP rate limits protect the API and our public tools against abuse and brute-force attempts
• Monitoring: Uptime and error monitoring, with current availability published on our status page

We implement robust authentication mechanisms to protect your account:

• OAuth Integration: Sign in securely with Google or GitHub using industry-standard OAuth 2.0
• Session Management: Signed, expiring session tokens (JWT) delivered in HTTP-only cookies
• CSRF Protection: Cross-site request forgery protection on all authenticated endpoints
• Secure Cookies: HTTP-only, secure cookies with SameSite attributes

Payment Security

All payment processing is handled by Stripe, a PCI DSS Level 1 certified payment processor:

• We never store, process, or transmit credit card numbers on our servers
• All payment data is handled directly by Stripe's secure infrastructure
• Subscription management and billing uses Stripe's secure customer portal

Data Retention & Deletion

We maintain clear policies around data retention:

• Synchronous API Requests: Processed in memory and discarded after returning results - the contents are not permanently stored
• Async Batch Jobs & Idempotency: Asynchronous batch jobs retain the submitted orders and results so you can poll for them, and are automatically deleted after 30 days; idempotency records expire after 24 hours
• Usage Logs: Request metadata (not payloads) is retained for billing and analytics purposes
• Saved Resources: Box sets, item catalogs, and rate cards are stored until you delete them or close your account
• Account Deletion: Contact us to delete your account; associated data is permanently removed within 30 days of the request

Vulnerability Reporting

We welcome responsible disclosure of security vulnerabilities. If you discover a security issue, please contact us at support@cartonpilot.com. We commit to:

• Acknowledge receipt of your report within 48 hours
• Provide an initial assessment within 5 business days
• Keep you informed of our remediation progress
• Not pursue legal action against good-faith security researchers

Security Best Practices for Users

Help us keep your account secure by following these recommendations:

• Use a strong, unique password for your CartonPilot account
• Enable OAuth sign-in with Google or GitHub for added security
• Store API keys securely using environment variables or secrets managers
• Regularly rotate your API keys, especially after team member changes
• Monitor your usage dashboard for unexpected activity
• Revoke unused API keys promptly