Security
Security your IT team can check for themselves
You are about to put your customer list, your pricing and your order history into someone else’s system. Here is exactly how it is protected, described plainly enough to be verified rather than taken on trust, along with where we are on formal certification.
Controls
How your data is separated and protected
Each distributor is a separate database
Tenancy is not a column on a shared table. Every distributor runs as its own database with its own credentials, on its own hostname. There is no query that could return another distributor's data, because there is no shared table to query.
Permissions are enforced on the server
Access control lives in the backend, not in the browser. The web app holds no privileged token and cannot read anything the signed-in user could not read by calling the API directly. Hiding a button is not a permission, and we do not treat it as one.
The browser never talks to the database
Every read and write goes through a server-side layer that holds the session and shapes the response. Credentials stay on the server, and a request with no valid session fails closed as an anonymous user rather than falling back to elevated access.
We never see a card number
Payments run through Stripe. Card, PayTo and BECS details are captured by Stripe directly and never reach our servers or our logs, which means our systems are not somewhere a card number can leak from.
Sessions are host-scoped
Session cookies are HTTP-only and scoped to the host that issued them, so a session on one distributor's portal is not a session anywhere else, including on their own back office.
Deploys are authenticated by certificate
Production changes go through a service that requires a client certificate signed by our own authority. A password alone cannot deploy, and the signing key is held offline.
Certification
Where we are on formal audits
Carrots has not completed a SOC 2 audit. We would rather tell you that here than four weeks into an evaluation, so you can weigh it early against everything else on this page.
What we offer in the meantime is substantive. We will answer your security questionnaire in full, walk your IT team through the architecture above in as much detail as they want, and write the commitments that matter to you into the contract. For most independent distributors that is the right trade, and if formal certification is a hard requirement for yours, tell us on the first call and we will say so plainly.
Questions from your IT team?
Send them our way. We will answer a questionnaire, or get on a call with whoever needs to sign this off.