Security
Security
Published 2026-07-04 · Living document
These policies are published for transparency and are maintained as living documents. They receive ongoing internal review and will receive formal legal counsel review before enterprise deployments. Questions: [email protected].
Infrastructure
Carriersfy AI runs on Cloudflare's global edge platform. All traffic is encrypted in transit (TLS). Application secrets are stored as platform secrets — never in source code or version control.
Application security
- Per-business isolation of knowledge and conversations, denied-by-default across tenants.
- Execution envelopes: employees can only perform explicitly authorized actions; blocked actions are logged.
- Reliability engineering: failed external writes (e.g. CRM) are queued and retried with idempotency keys — never silently dropped.
- Automated test suite (216 tests as of 2026-07-04) including failure-mode and concurrency tests, run before deployments.
- Enterprise architecture supports per-tenant envelope encryption with customer-managed keys, cryptographic shredding, and hash-chained tamper-evident audit logs.
What we don't claim
We do not currently hold SOC 2 or ISO 27001 certifications and will not claim them until audited. Formal certifications are on the roadmap and will be published in the Trust Center when achieved.
Reporting a vulnerability
Email [email protected] with subject "SECURITY". We acknowledge reports within two business days and appreciate responsible disclosure.