Security

Your clients’ post is sensitive, so we treat it that way.

• UK only. Scans are stored and processed on Google Cloud in London (europe-west2). AI reading and classification uses Google’s Vertex AI in the same London region, with prompt caching switched off. Your documents are never used to train anything.
• Encrypted. TLS in transit; AES-256 at rest with keys we manage in Google Cloud KMS.
• Isolated. Each firm’s data is separated at the database level with row-level security, not just in the application.
• Locked down. Portal access requires multi-factor authentication. Integration credentials are held in Google Secret Manager, never in the database.
• Logged. Every action, by a person or the system, is recorded in an audit log you can see.
• Deleted on your schedule. Scanned letters are deleted after the period you set (default 90 days). Filed copies stay in Karbon under your control.
• Your processor. We act as your data processor under a signed GDPR Data Processing Agreement. See our sub-processors.

Questions? Ask us anything about how we handle your data.