Where is my data stored?

On servers we operate in the United States. Backups are stored with Cloudflare in North America. Email you send to support is stored by Google Workspace, which may keep it outside the United States.

Who at Carton Pack Pro can see my data?

Only Unstacked Apps, LLC has access to production systems. Changes we make to your account are recorded in its activity log.

Can I get a copy of my data?

Read your cartons, items and pack jobs through the REST API: GET /api/v1/cartons, /items and /jobs. For a full copy, email support@cartonpackpro.com. We reply within 30 days.

How do I delete my account?

Email support@cartonpackpro.com. We delete your account and its data within 30 days, backups included.

Is my data used to train AI models?

No. Carton Pack Pro sends your data to no AI service.

Trust and security

How Carton Pack Pro handles your data.

Reviewed 5 November 2026

Controls in place today.

Hosting and network

Runs on servers we operate in the United States
Every request passes through Cloudflare
The server accepts web traffic from Cloudflare only
Production access is limited to Unstacked Apps, LLC
API responses are sent with Cache-Control: no-store

Roles and organizations

Three roles: Owner, Admin and Member
Owners and Admins manage API keys, the team, the plan and integrations
Only an Owner can add or change another Owner
Every database read on your behalf is limited to your organization
Changes we make to your account are recorded in its activity log

API and integrations

API keys are shown once, when you create them
Each key gets read scope, write scope or both
Revoke a key at any time under API keys
Requests a minute per key: Free 30, Pro 300, Business 1,200 and Enterprise 1,200
Webhooks are signed with HMAC-SHA256 in X-CartonPackPro-Signature
NetSuite order requests are signed the same way
In NetSuite, your keys are kept in NetSuite's API Secrets

Backups, logs and retention

The database is backed up daily to Cloudflare R2
Backups are kept for 14 days
A restore from backup is tested every week
Account actions are logged with who made them
Pack jobs: Free keeps them for 30 days, Pro keeps them for 90 days, Business keeps them for 365 days and Enterprise keeps them with no time limit
Server logs are overwritten as new entries are written

Full retention list →

Encryption and stored secrets.

In transit
Web and API traffic	HTTPS
Strict-Transport-Security	2 years, subdomains included

At rest
Password	scrypt hash with a unique salt
Session token	SHA-256 hash
API key	SHA-256 hash and its first 12 characters
Password reset and invitation links	SHA-256 hash
ShipStation API key	AES-256-GCM. Screens show the last 4 characters.
Webhook and NetSuite signing secrets	Plain text: both sides sign with them
Backups	Encrypted with restic (AES-256) before upload

Not available yet.

No SOC 2 report, ISO 27001 certificate or penetration test yet.
No two-factor sign-in, SSO or SCIM yet.
The live database disk is not encrypted. Backups and ShipStation keys are.
Account actions are logged, but you can't view the log in the app yet. Ask support for it.
No uptime SLA. Terms, section 8

Services that receive your data.

Stripe, Inc.

Use: Payments, invoices and sales tax for paid plans, as merchant of record.
Receives: Your organization's name, its owner's name and email, and your plan. Card details are entered with Link, Stripe's payment service.

Cloudflare, Inc.

Use: DNS, network proxy, email routing and backup storage.
Receives: Every request to cartonpackpro.com, email sent to our addresses, and the encrypted backups.

Google LLC

Use: Google Workspace hosts our mailbox.
Receives: Every email you send to [email protected].

Resend, Inc.

Use: Sends password reset emails, and Enterprise enquiries from the contact page to us.
Receives: Your email address and the message. For an enquiry, also your name, company and orders shipped per month.

ShipStation API

Use: Shipping rates, only when you connect your own key.
Receives: Each carton's size and weight, and the ship-from and ship-to postal code and country.

Oracle NetSuite is your provider, not ours. Rates and labels requested in NetSuite go from your NetSuite account straight to your ShipStation API account.

Common questions.

Where is my data stored?	On servers we operate in the United States. Backups are stored with Cloudflare in North America. Email you send to support is stored by Google Workspace, which may keep it outside the United States.
Who at Carton Pack Pro can see my data?	Only Unstacked Apps, LLC has access to production systems. Changes we make to your account are recorded in its activity log.
Can I get a copy of my data?	Read your cartons, items and pack jobs through the REST API: GET /api/v1/cartons, /items and /jobs. For a full copy, email [email protected]. We reply within 30 days.
How do I delete my account?	Email [email protected]. We delete your account and its data within 30 days, backups included.
Is my data used to train AI models?	No. Carton Pack Pro sends your data to no AI service.

Report a security issue.

Email [email protected] with the steps to reproduce it.
If we confirm a breach of your data, we email your organization’s owners within 72 hours.
Testing our security needs our written permission first (Terms, section 5).