Security
What is in place for the Carqo website and accounts today. Each statement on this page is backed by our own code.
Where Carqo runs
The Carqo website runs on Cloudflare.
Carqo's database is run by Supabase, in London.
In production, Carqo will not start if its database is set up anywhere else.
Connections
Every page on carqo.co.uk tells your browser to connect only over HTTPS.
Browsers keep to this for two years, for carqo.co.uk and all its subdomains.
Signing in
You sign in with a link we email to you. Carqo never asks for or stores a password.
Each link works once, and stops working after 15 minutes.
Once a new link is sent, earlier links stop working.
We keep only a one-way hash of each link and session, so a copy of our database cannot be used to sign in.
Who can see what
Each workspace has four roles, Owner, Administrator, Analyst and Viewer.
Only an Owner can add people, remove them or change their role.
Each request is checked against the person's role before it runs.
A person in one workspace has no access to another.
The app connects to the database as a restricted login, never as an administrator.
Reporting a flaw
If you find a flaw in this website, email hello@carqo.co.uk.
We acknowledge every report within five working days.
We will not take legal action against anyone who reports a flaw in good faith and does not access, alter or retain other people's data.
We do not run a bounty, and we do not promise a fix by any date.
The full policy is in our security.txt file.