Safeguarding your data, earning your trust

Trust, transparency, and integrity matter. Carta has a robust defense-in-depth strategy to safeguard your data.

Security program overview

Identity and access management
Identity and access management
  • Unique employee accounts and no shared logins
  • VPN gate and multi-factor authentication
  • Periodic user access reviews
  • Limited and restricted access to sensitive data
  • Automated deprovisioning
Vulnerability management illustration
Vulnerability management
  • Vulnerability and patch management program
  • Internal and external scanning
  • Periodic penetration testing by a third party
  • Bug bounty program
  • Static code analysis
Vender due diligence illustration
Vendor due diligence
  • VDD program to review and approve all new vendors and renewals
  • Cross-functional reviews
  • Periodic reviews of critical and high risk vendors
  • Published Supplier Information Security Standards and Code of Conduct (CoC)
Risk management illustration
Risk management
  • Risk identification and treatment program
  • Cross-functional risk governance
  • Internal periodic risk assessments
  • Periodic risk assessments by an audit firm
  • Executive Risk Council
Network and data protection illustration
Network and data protection
  • Virtual Private Clouds (VPCs) and security groups
  • Network and application firewalls
  • Segregated environments
  • Static code analysis
  • Encryption at rest (AES256)
  • Encryption in transit (TLS1.2+)
Threat detection and incident response illustration
Threat detection and incident response
  • Application and infrastructure logging
  • Log aggregation into a SIEM for monitoring and triage
  • Annual review, approval and testing of incident response procedures
  • Security reporting mechanisms for internal and external users
Resiliency illustration
Resiliency
  • Highly available architecture
  • Multiple backup solutions
  • Daily backup restores
  • Business Continuity Plan tested annually
  • Continuous availability/performance monitoring and response
Configuration and change management illustration
Configuration and change management
  • Software Development LifeCycle (SDLC)
  • Peer reviews and automated testing
  • Continuous integration and continuous delivery (CI/CD)
  • Vulnerability scanning during development
  • Infrastructure as Code (IaC)
People operations illustration
People operations
  • Defined roles and reporting lines
  • InfoSec policy and Employee Handbook/CoC acknowledgements
  • Employee competency and performance evaluations
  • Background checks
  • Security awareness training

Security compliance

Carta undergoes annual external audits by multiple independent auditors. These reports, plus additional security documentation, are available to all customers, prospects, and vendors on our customer trust platform, Conveyor. Learn more here.

Icons - Item | Trust Center | "SOC 1 reports covering each of our core services and a SOC 2 report covering the platform"

SOC 1 reports (core services), SOC 2 report covering the platform

Icons - Item | Trust Center | "ISO 27001 certification"

ISO 27001 certification

Additional resources

Privacy

Understand the policies and procedures in place to protect your privacy:

  • Learn how Carta collects, uses, and shares your information in our Privacy Policy

  • See details regarding the use of cookies on our website in our Cookie Policy

Responsible disclosure

We are always interested in adding talented researchers to our HackerOne disclosure program. If you believe you have discovered a vulnerability or are an interested security researcher, please get in touch with us at security@carta.com .

For more details, please refer to our Responsible Disclosure Policy .

Vendor management and security

Carta is committed to the highest social responsibility standards and ethical conduct. Our Supplier Code of Conduct applies to all suppliers, vendors, consulting partners, and service providers.

In addition, our Supplier Information Security Standards lists the minimum security controls that Carta’s suppliers are required to adopt when:

  • accessing Carta facilities, networks, or information systems

  • handling confidential information, or processing Carta data on supplier’s systems

  • in custody of Carta hardware assets