Security
Company travel and expense data is sensitive. This is how Carreh for Business protects it.
Separate by design
Its own accounts, database, storage and keys, separate from Carreh's consumer apps.
Each company stays its own
Every request is checked against the person's company and role. Tests check that one company can never reach another's data.
Sign-in without passwords
One-time codes sent to your work email. Sessions are stored only as hashes and end when you sign out.
Carreh staff access
Staff need an authenticator app to sign in, and can open your workspace content only with your approval, for a limited time, recorded in your action log.
Encryption
Encrypted in transit and at rest. Secret keys are encrypted with AES-256-GCM; codes and tokens are stored only as hashes.
Action log
Sign-ins, invitations, role changes and other administrative actions are written to a log that cannot be edited or deleted.
Your data, your AI
AI never approves, submits or pays on its own, and your data is never used to train AI models.
Stored in the EU
Carreh for Business data is stored in the European Union, with point-in-time recovery and backups.
Report a security issue
Write to business@carreh.com with "Security" in the subject. Please give us reasonable time to fix an issue before disclosing it.