Security
Cartful is built for enterprise ecommerce teams that need buyer trust, rigorous merchandising control, and a platform that can stand up to procurement and security review.
Compliance
- SOC 2 Type II certified.
- SOC 2 Type II report available under NDA upon request.
- We support standard enterprise procurement and security review processes.
Privacy-forward defaults
- Emails and names can be captured and sent via encrypted API directly to downstream tools when configured.
- Cartful does not store IP addresses or device identifiers.
- Cartful stores aggregated analytics, not personally identifiable data (PII), by default.
- Free text answers are not stored anywhere.
Analytics retention
- Raw analytics events (without direct identifiers): 6 months.
- De-identified aggregated rollups (US): 36 months.
- De-identified aggregated rollups (EU): 13 months.
Data use and access
- Data sent to downstream tools depends on what you configure (events and/or attributes).
- Access and workflows should be aligned to your team's needs and governance requirements.
Related policies
Frequently asked questions
Are you SOC 2 certified?
Yes. Cartful is SOC 2 Type II certified.
Do you store personal data?
By default, Cartful stores aggregated analytics, not personally identifiable data (PII). Emails and names can be captured and sent via encrypted API directly to downstream tools when configured. Cartful does not store IP addresses or device identifiers, and free text answers are not stored anywhere.
What do you store for analytics, and how long?
Raw analytics events without direct identifiers are retained for 6 months. De-identified aggregated analytics rollups are retained for 36 months in the United States and 13 months in the European Union.
Can you support enterprise security reviews?
Yes. We work with enterprise brands and can support standard procurement and security review processes.
See Cartful in action
Get a live walkthrough tailored to your catalog.