We guarantee 99.9% uptime. Our 24/7/365 On-Call Team continuously monitors the performance and integrity of our online services, from individual API requests to configuration changes and responses to intrusion attempts. We monitor our systems via continuous, comprehensive, securely-stored logs. An automatic remediation framework, built around a central knowledge base, allows us to anticipate potential issues, make smart decisions, and automate actions to prevent them from happening. We are proactive, rather than reactive.

We store your CARTO data on Google Cloud Engine. Google's data centers are state-of-the-art, and they have achieved ISO 27001 Certification. Physical access is strictly controlled by professional security staff, video surveillance, state of the art intrusion detection systems, and other electronic means. Authorized personnel must pass repeated two-factor authentication to access data center floors. Environmental security controls to safeguard against fire, power fluctuations and outages, and challenging weather conditions.

Our offices are secure too. Each one uses a combination of electronic card access, security codes, and/or video surveillance.

We’re constantly bringing new features and enhancements to CARTO. Our 3-tier testing process ensures that every change to the code base is checked from every angle prior to deployment. We're able to deploy code more than a dozen times each day while maintaining exceptional quality and security.

Sunlight is the best disinfectant. CARTO is built using many open source components, and one advantage of open source is that every line is reviewed by many eyeballs and tested in a wide variety of configurations by a huge community. Problems are surfaced quickly, and the community can help with the fix. We thoroughly review code and licensing for all open source components prior to use, to protect you from IP-related usage restrictions and claims.

Our technical staff are experts in the latest standards in secure software development, and make use of industry best practices, such as the Open Web Application Security Project (OWASP).

We conduct comprehensive criminal and employment history background checks to the extent permitted by law. We use two-factor authentication, logical role controls, and private/publish keys in our operations. Everyone at CARTO has signed confidentiality agreements to protect your data. Our team receives tools and training for handling sensitive data and safeguarding technical and non-technical assets.

We do not store your credit card information on our servers. We process payments with Recurly, which is certified to PCI Service Provider Level 1. This is the strictest level of PCI DSS certification. Payment information is transmitted directly to Recurly via HTTPS for secure storage.

We regularly review our hardware, software, and physical security configurations. Our Security Committee ensures that all areas of the company work together to keep you safe.

Need more? For total control of your data, we offer CARTO On-Premises, putting all the features and functionality of our cloud-based platform on your infrastructure and behind your firewall. Let us know what you need. We can help!