Quietly secure.
Always working.
Your money, your account, and your data — protected by layers you never have to think about.
How we keep things safe
Three jobs. Done in the background.
Behind every Carrot payment is a stack of encryption, monitoring, and partners doing the heavy lifting.
Your money
Stays exactly where it belongs.
When you connect a bank account, your credentials never touch our servers. Plaid handles that on its end. Every transfer is encrypted in transit and signed at every step. Funds settle through our regulated banking partners, not a workaround.
256-bit encryption in transit and at rest
Bank connections handled by Plaid, never stored as passwords
Regulated banking partners process every payment
Your account
No one gets in but you.
Two-factor authentication is on by default. Logins are watched for unusual devices, locations, and patterns. If something looks off, we pause first and ask questions later. And if you spot something we missed, our support team is real humans, reachable fast.
Two-factor authentication on every account
Device and location monitoring
Real-time alerts for new sign-ins and large transactions
Your data
Stays yours. Always.
We collect what`s needed to make payments work, and nothing else. Your data is encrypted at rest, encrypted in transit, and never sold. You can request a full copy of what we have, or ask us to delete it, anytime.
AES-256 encryption at rest, TLS in transit
We never sell your data
Request, export, or delete your data anytime
Our promise
A list of things
we’ll never do
1
We will never sell your personal data. Not now. Not ever.
2
We will never ask for your password by phone, email, or text.
3
We will never store your passwords in plain text.
4
We will never share your transaction history outside Carrot without your explicit permission.
Your part
Small steps.
Strong defense.
Most fraud doesn't break in. It walks in. A few quick habits make sure that never happens to you.
Two-factor, built in
Every login sends a one-time PIN. There's nothing to turn on — that's just how sign-in works.
No password on file
Carrot doesn't use passwords. Sign-in is PIN-based, so there's nothing stored for anyone to steal or reuse.
Watch your alerts
We send a notification for every sign-in and cashback payout. If one looks unfamiliar, tap it and let us know.
Never share a code
No one at Carrot will ever ask for your one-time code. If someone does, they`re not us.
Our partners
The best in the business.
Behind the scenes.
We don't build security from scratch. We partner with the companies trusted by the largest banks, fintech, and most regulated industries in the country.
Securely connects your bank account without storing your credentials.
Securely processes payments and reimbursements with bank-level protection.
Continuously monitors our security controls, so we stay audit-ready every day.
Security audits
Independently checked.
Regularly tested.
We follow SOC 2 standards for security, availability, and confidentiality. We comply with CCPA and GDPR for member data rights. And we pay outside auditors, not just our own team, to find what we missed.
SOC 2
Independently audited security controls.
CCPA / GDPR
Member data rights, respected by default.
Annual Security Testing
Independent security experts test our systems annually.
Report an issue
See something? Say something.
We follow SOC 2 standards for security, availability, and confidentiality. We comply with CCPA and GDPR for member data rights. And we pay outside auditors, not just our own team, to find what we missed.
For Members
See something off
in your account?
Contact us through our app, or email us. We treat every report as urgent and respond within one business day.
For Security Researchers
Found a
vulnerability?
We welcome responsible disclosure. We'll respond, fix, and credit your work.
Steady revenue, on autopilot
Turn your offer on and get back to running your business. Carrot finds the customers, verifies the purchases, and settles up every Friday.
