Are you SOC 2 certified?

Yes. Cartful is SOC 2 Type II certified. The full report is available under NDA on request, and we support standard enterprise procurement and security review processes.

Do you store personal data?

No. Cartful stores aggregated analytics rather than personally identifiable data. IP addresses and device identifiers are not collected, and free text answers are discarded at capture. Emails and names are sent by encrypted API to your tools only when you configure that.

What do you store, and how long?

Raw analytics events carry no direct identifiers and are kept for 6 months. De-identified aggregate rollups are kept for 36 months in the US and 13 months under EU data residency.

Can you support enterprise security reviews?

Yes. Send us your questionnaire and we will complete it. The SOC 2 Type II report is available under NDA.

Security & privacy

Everything a security review asks for, in one place.

Cartful is SOC 2 Type II certified. Below: what we store, how long we keep it, and the documents your team needs.

Request the SOC 2 report Policies and documents

Data disposition · live logDefault policy

10:24:01 answer.captured → aggregate rollup · no identifiers

10:24:01 free_text → discarded at capture

10:24:02 ip_address → never collected

10:24:02 device_id → never collected

10:24:19 email.submitted → encrypted API · your config only

10:24:20 listening

SOC 2 Type II

Report under NDA

EU data residency

Rollups kept in region

Compliance

Certified, reviewable, and configured by you.

Security and legal can sign off without a special build. The report goes out under NDA, and we complete the questionnaires your procurement process requires.

SOC 2 Type II

Audited annually

Enterprise review

Send us the questionnaire

We complete standard security questionnaires and support enterprise procurement review, with the full SOC 2 report available under NDA.

SOC 2 Type IIReport under NDAQuestionnaires completed

Data use and access

You configure what leaves

Nothing is forwarded downstream unless you set it up. Events and attributes move to your stack by encrypted API, and you pick which ones.

events + attributes → your stackSee integrations →

Analytics retention

How long we keep it.

DataIdentifiersUnited StatesEU residency

Raw analytics events

No direct identifiers

United States

6 mo

EU residency

6 mo

Aggregated rollups

De-identified

United States

36 mo

EU residency

13 mo

Free text answers

Not applicable

United States

not stored

EU residency

not stored

Bars to scale · 36 months max

EU data residency keeps aggregate rollups in region.

Documents

Send your questionnaire or NDA and we will complete it.

FAQ

Common questions.

Get started

See Cartful in action.

Get a live walkthrough tailored to your catalog.

Book a demo Explore the platform

Everything a security review asks for, in one place.

Certified, reviewable, and configured by you.

Send us the questionnaire

You configure what leaves

How long we keep it.

Raw analytics events

Aggregated rollups

Free text answers

Policies and documents.

Privacy Policy

End user privacy

Website Terms of Use

Subprocessors

Responsible disclosure

Common questions.

See Cartful in action.