Security
The protection of dealership data comes first. The practices below describe how Carlio keeps it secure.
Last Updated:
Commitment to Security
A dealership keeps its purchase prices, margins, customer records and documents in Carlio. The platform is built so that this information reaches only the people the dealership chooses, and each practice below describes how.
Data Encryption
Encryption in Transit
All traffic between browsers and Carlio's servers is encrypted with Transport Layer Security, so information cannot be read or altered on its way.
- HTTPS enforced on the website, dashboard, portals and API
- Files uploaded to and downloaded from storage over HTTPS only
Encryption at Rest
- Uploaded files stored in Cloudflare R2, which encrypts every object at rest
- Account and partner portal passwords stored only as one-way hashes that can never be read back
Authentication and Access Control
Strong Authentication
- Email verification required before an account can sign in
- Sign-in with Google through OAuth 2.0
- Sessions held in HTTP-only cookies and checked on the server with every request, so a revoked session stops working immediately on every device
- Invisible reCAPTCHA v3 on sign-up, sign-in, password reset and the contact form
Organization-Level Security
- Members added to an organization by invitation only
- Roles with defined permissions, assigned by the organization owner
- Access changed or revoked by the owner at any time
- Permissions enforced on the server for every request, not only in the interface
Infrastructure Security
- Website and dashboard hosted on Vercel, with platform-level DDoS mitigation
- Application server, background workers and cache hosted on Railway
- Files stored on Cloudflare R2
- Secrets held in the hosting platforms' encrypted environment settings
Application Security
File Upload Security
- Each upload authorised by the server first, with its file type and exact size signed into the upload link, so storage rejects any file that does not match
- A storage allowance per organization, checked before an upload is permitted
- Public vehicle photographs optionally watermarked with the dealership's logo
Cross-Origin Protection
- The API accepts browser requests only from Carlio's own web origin
Data Privacy and Isolation
Data Isolation
- Every record belongs to one organization
- Every query scoped to the organization of the signed-in member
- File locations built on the server from identifiers it already holds, never from values supplied in a request, so one organization cannot address another's files
- Private documents kept in a storage bucket with no public address and served only through short-lived signed links
Privacy by Design
- Only the information needed to run the Service is collected
- Personal information shared only with the providers needed to deliver the Service
- A transparent Privacy Policy describing every use
Portals and Shared Links
- Customer, partner and task links built on 32-byte random tokens, unique across the platform and impossible to guess or enumerate
- An optional expiry date on every link, after which it stops working
- Optional passwords on partner portals, stored as PBKDF2 hashes, with unlock attempts limited to five every fifteen minutes
- A changed portal password signs out every device that had already unlocked it
- Each portal shows only the fields designed for its reader: a customer never sees a purchase price or commission, and a partner never sees the buyer
Payment Processing
Carlio works with Polar for payment processing. Complete card details are never received or stored on Carlio's servers.
- All payment information handled by Polar
- Card payments processed through PCI DSS compliant processors
- Payment events delivered through signed webhooks, verified before they are applied
Third-Party Services
Carlio relies on a small set of established providers:
- Polar: payment processing and subscription management
- Cloudflare: file storage
- Vercel and Railway: application hosting
- Google: sign-in and reCAPTCHA
- Resend: email delivery
- ExchangeRate-API: exchange rate data
The information each provider receives is listed in the Privacy Policy.
Reporting Security Issues
Responsible disclosure of a suspected vulnerability is welcomed. A report should be sent as follows:
- Email: support@carlio.app
- Include a description of the issue, the steps to reproduce it, and its impact
- Allow reasonable time to fix the issue before any public disclosure
- Every report is acknowledged within 48 hours
Carlio does not currently run a bug bounty programme.
Security Best Practices for Users
- Use a strong password that is not used for any other service, or sign in with Google
- Review organization members and their roles regularly, and remove anyone who has left
- Set an expiry date on portal and task links, and a password on partner portals
- Send each link only to its intended recipient
- Treat unexpected emails asking for credentials with caution
- Sign out of Carlio on shared or public computers
- Report suspicious activity to support without delay
Incident Response
A suspected incident is investigated as soon as it is identified, and affected organizations are notified as the law requires.
Questions About Security?
Questions about these practices may be sent to the address below or through the contact page.
Related: Privacy Policy, Terms of Service