Fans Of Free lifted overall conversion 35% after installing Carti.Start free trial →

Security and data privacy

Your store data and your customers' information deserve real protection, not vague promises. Here is exactly how Carti keeps everything secure.

Your conversations never train AI models

Every API call to our AI providers is configured with data opt-out flags. Your customer conversations, product data, and store information are never used to train or improve third-party language models. Period.

Customer PII stays out of AI prompts

Before any conversation reaches our AI, we strip personally identifiable information. Email addresses, phone numbers, and shipping addresses are never sent to the language model. Only the context needed to help your customer (like first name and order status) is included.

Encryption at every layer

All data in transit is protected with TLS. Stored data is encrypted using AES-256-GCM and HMAC-SHA256 verification. Your API keys and credentials are never stored in plain text.

Full GDPR data handling

Carti implements all three Shopify mandatory privacy webhooks with complete, production-grade handlers. Customer data export, customer data deletion with anonymization across all tables, and full shop data redaction. These are real implementations, not stubs.

AI guardrails

Carti can only offer discounts, promotions, and responses that you have explicitly configured. Shoppers cannot manipulate the assistant into revealing sensitive information or overriding your store policies.

Shop-scoped data isolation

Every database query is scoped to your shop. There is no cross-store data access. Your products, conversations, and customer interactions are completely isolated from every other merchant on the platform.

What Carti will never do

  • Use your conversations or customer data to train AI models
  • Send customer email addresses, phone numbers, or shipping addresses to AI providers
  • Share your store data with other merchants or third parties
  • Store credentials or API keys in plain text
  • Access Shopify data beyond what is needed to power the sales assistant

Common questions

Does Carti store my customer conversations?

Yes, conversation history is stored so your AI assistant can reference previous interactions and so you can review conversations in your dashboard. All stored data is encrypted and scoped exclusively to your shop.

Can shoppers trick the AI into giving unauthorized discounts?

No. Carti can only offer discounts and promotions that you have explicitly configured in your store settings. The AI is designed to stay within the boundaries you define.

What happens to my data if I uninstall Carti?

When you uninstall, Shopify sends a shop redaction webhook. Carti processes this by systematically removing or anonymizing your data across all tables. This is a full, automated cleanup.

Is Carti SOC 2 certified?

Not yet. We are a growing team and SOC 2 certification is on our roadmap. In the meantime, we implement the same security practices (encryption, access controls, data isolation, GDPR compliance) that SOC 2 requires.

What Shopify data does Carti access?

Carti accesses your product catalog, collections, and order data to provide accurate responses to customer questions. We request only the Shopify API scopes needed to power the sales assistant experience.

Questions about security?

If you have specific security questions or need details for your compliance review, reach out and we will get back to you within one business day.

Contact us

Meet your store's best salesperson

Carti answers questions, recommends products, and closes sales 24/7

Schedule Demo

14-day free trial