Security, plainly.
Where your data lives, how it is kept, and what we do not have.
How Cardr keeps your data
Where it lives
Your card and contacts are in our database on Railway’s servers in the United States. Every visit reaches them through Cloudflare.
Always encrypted in transit
The site is HTTPS only, and browsers are told to keep it that way for two years.
Keys sealed at rest
Anything that can act for you, such as a Sign in with Apple token or a CRM connection, is sealed with AES-256-GCM before it is stored. Without the key, those features stay off rather than store it unsealed.
Backed up off-site
Every change is copied to Cloudflare R2 in the European Union within about 10 seconds, with a full snapshot each day, kept for 7 days.
No passwords
You sign in with a one-time email link or a passkey (Face ID, Touch ID or your device PIN), or with Apple or Google. There is no password to leak.
On a team
For team contacts the company is the controller and Cardr its processor. Anyone a member marks Personal is never shared.
Cardr has no SOC 2 report.
Cardr does not hold SOC 2 or any other certification. What we do is listed above, and every line is true today.
Found a problem? Tell us.
Email support@cardr.co with “Security” in the subject. Say what you found and how to see it. Please do not look at other people’s data to prove it.
Security, answered.
Does Cardr have SOC 2?
No. Cardr does not hold a SOC 2 report or any other security certification. If your company needs one before it buys, Cardr is not the right choice for you, and we would rather say so here than after a call.
Who else handles our data?
Railway runs the servers and the database, Cloudflare carries traffic and stores the backups, Resend sends email, Stripe takes payments, Google’s Gemini API writes drafts and reads scanned cards, and Apple delivers pass updates. The full list, with where each one is.
What happens to a scanned card?
On the website, a QR on a card or badge is read on your own phone or computer. Otherwise the photo is sent to Google’s Gemini API to read the printed text, and Cardr does not keep it. You check what it read before anything is saved. The full notice.
Can we get our data out?
Yes. Every plan exports contacts to CSV and vCard at any time. On Cardr Teams, an admin exports the team’s leads as CSV.
What happens when we delete an account?
The card, contacts, scans and settings are deleted at once. The backup drops its copy of the database within 8 days, and a deleted photo or logo within 30. How long we keep things.
Where do CRM leads go?
Only where an owner or admin connected them, on the company’s instruction. What happens to them in that CRM is the company’s.
Bring your team.
Set up free in about a minute. 14 days free once a colleague joins.