Security at Carton
We're a small company, so we won't hand-wave with badges. Instead, here is specifically how Carton is built to protect your data — including the parts of your data we designed ourselves out of being able to touch.
Architecture: the best data protection is not holding the data
- Your mailbox never rests on our servers. Email syncs directly between your Mac and Gmail, Microsoft, or your IMAP server. Our infrastructure holds neither a copy of your messages nor a credential that can retrieve them.
- Mail credentials live in the macOS Keychain on your device — encrypted by the operating system, gated by per-app access control.
- Narrow permissions by design. Carton requests the minimum Google scopes for what it does (read/organize and send) rather than blanket account access.
- Calendar and reminders are read from macOS's own stores on your Mac, never uploaded to us.
For the data we do store
- Encryption in transit everywhere (TLS).
- Server-enforced access rules. Every read and write to CRM data is checked against per-user and per-team security rules on the server — not in the app, where they could be bypassed.
- Verified identities. Password accounts must verify their email before touching data; sign-in also supports Google and Microsoft SSO.
- Secrets hygiene. API keys and server credentials live in Google Secret Manager — never in the app binary, never in source control.
- Separated environments. Changes are rehearsed in an isolated staging environment before they reach production infrastructure.
AI features
- Every data category is off by default for the AI; you enable each one explicitly.
- AI requests are processed transiently — our proxy streams data through to the model provider and stores none of it. We log token counts only.
- Destructive or outward-facing AI actions (sending email, deleting records) require your explicit confirmation in the app.
Honesty about where we are
Capralis does not currently hold formal certifications like SOC 2 — at our size, a certificate would say less about your safety than the architecture above does. As the company grows, formal audits are on our roadmap, and this page will always state exactly what is and isn't true.
Reporting a vulnerability
If you find a security issue in Carton or capralis.com, please email security@capralis.com. We commit to acknowledging reports within 48 hours, keeping you informed as we investigate, and crediting you (if you'd like) when the fix ships. Please give us reasonable time to fix issues before public disclosure.