Your data remains yours
- Full data portability
- You set retention policies
- Complete deletion on request
Security
Institutional-grade handling for confidential deal material.
Carriage works with CIMs, data rooms, operating data, and financial detail that cannot leak. This page is the reference for your IT, compliance, and diligence teams.
Posture
Ownership, control, and protection.
Access follows your governance model
- Role-based access control
- Complete audit logging
- SSO and MFA enforcement
Controls for sensitive financial work
- AES-256 at rest, TLS 1.3 in transit
- 100% US data residency
- Runs on SOC 1/2/3-certified infrastructure
AI data protection
Your data never trains AI models
For supported AI processing, documents and financial data are handled ephemerally under zero-retention terms: not used for model training, not stored by model providers, and deleted after the request completes.
- Zero Data Retention agreement in effect
- Stateless, ephemeral processing architecture
- No customer data stored by AI providers
- Processing isolated within a Google Cloud VPC
Technical detail
The specifics your reviewers will ask for.
Infrastructure
- Cloud provider
- Google Cloud Platform
- Data region
- US-based data centers
- Network architecture
- Zero-trust with VPC isolation
- Provider certifications
- SOC 1/2/3, ISO 27001, FedRAMP (held by Google Cloud)
Encryption and residency
- Encryption at rest
- AES-256 (NIST FIPS 197)
- Encryption in transit
- TLS 1.3 (IETF RFC 8446)
- Key management
- Google-managed CMEK
- Data residency
- 100% United States
Access and authentication
- Authentication
- SSO/SAML, OAuth 2.0, MFA required
- Authorization
- Role-based access control
- Session management
- Auto-logout on inactivity, encrypted credentials
- Audit
- Complete access and action logging
Governance
- Security framework
- NIST Cybersecurity Framework
- Cloud security
- CSA STAR Level 1 (self-assessment registry)
- Partner status
- Microsoft Partner Network, Google Cloud Partner
- Security assessments
- Annual third-party reviews
Certifications are attributed to the party that holds them. SOC 1/2/3, ISO 27001, and FedRAMP are held by Google Cloud as the underlying infrastructure provider. CSA STAR Level 1 is a self-assessment registry listing. Send diligence questions to security@carriagemodels.com.
The best way to understand Carriage is to give us real work.
Start with a live deal workflow or a recurring portfolio process. We will scope the execution path, evidence standard, and measurable value.