Data Handling & Privacy

Carriyo processes data on behalf of our customers as a data processor. The types of data processed depend on the services used and integration configuration.

• At rest: AES-256 encryption for all database storage and backups
• In transit: TLS 1.2 or higher for all external and internal communications
• Key management: Encryption keys managed through cloud provider KMS with automatic rotation
• Application-level: Sensitive fields (credentials, tokens) encrypted at the application layer in addition to storage-level encryption

Production data is hosted in AWS eu-west-1 (Ireland); customers may opt into a paid cross-region DR replica in AWS us-east-2 (US).

Carriyo retains customer data per the customer agreement and our retention policy. Upon contract termination:

• Customers can request data export in standard formats (JSON, CSV)
• Data is securely deleted after the retention period using industry-standard methods
• Deletion confirmation is provided upon request
• Backup data is purged according to the backup rotation schedule

• Role-based access control (RBAC) for all platform users
• Principle of least privilege enforced across all systems
• Multi-factor authentication (MFA) required for all administrative access
• SSO integration supported (SAML 2.0 and OIDC)
• All access to customer data is logged and auditable

Carriyo supports customers in fulfilling data subject requests under GDPR and other privacy regulations, including rights of access, rectification, erasure, data portability, and restriction of processing.