# Carta

Carta (carta.com): subprocessors, data processing agreement, security documents and changes, as monitored by Third Party Index.

- Page: https://thirdpartyindex.com/vendors/carta
- Documents last verified: 2026-09-29
- Transparency rating: 82/100 (how much it publishes, not how secure it is)
- Cite as: Carta, Third Party Index, https://thirdpartyindex.com/vendors/carta (data CC BY 4.0)

## Documents

| Document | URL | Last verified | Last changed |
|---|---|---|---|
| Trust center | https://trust.carta.com/ | 2026-09-29 | 2026-09-29 |
| Subprocessor list | https://carta.com/legal/privacy/sub-processors/ | 2026-09-29 | 2026-09-29 |
| Privacy policy | https://carta.com/legal/privacy/privacy-policy/ | 2026-09-29 | 2026-09-29 |
| Terms | https://carta.com/legal/terms-agreements/terms-service/ | 2026-09-29 | 2026-09-29 |
| Security page | https://carta.com/security/ | 2026-09-29 | 2026-09-29 |
| Status page | https://status.carta.com/ | 2026-09-29 | 2026-09-29 |
| Security advisories | https://carta.com/security/responsible-disclosure-policy/ | 2026-09-29 | 2026-09-29 |

## Subprocessors (51)

As its own list states them.

| Subprocessor | Purpose | Location | Listed since |
|---|---|---|---|
| [Alloy](https://thirdpartyindex.com/vendors/alloy.md) | Identity management system to fulfill KYC/AML and customer identification requirements | USA | 2026-09-29 |
| [Amazon Web Services](https://thirdpartyindex.com/vendors/amazon-web-services.md) | Cloud–based application platform and file storage for application file data, backups of system data, and backup of general company data.; Datacenter colocation services | EU and USA; USA | 2026-09-29 |
| [Amplitude](https://thirdpartyindex.com/vendors/amplitude.md) | User data analytics | USA | 2026-09-29 |
| [Anthropic, PBC](https://thirdpartyindex.com/vendors/anthropic.md) | AI inference and data analysis | USA | 2026-09-29 |
| Anvil | Contract generation and electronic signature tool | USA | 2026-09-29 |
| [Atlassian](https://thirdpartyindex.com/vendors/atlassian.md) | Provides a cloud-based bug tracking system, where we may process end user data to the extent necessary to reproduce and fix bugs, and in general as necessary to deliver and improve the Carta Europe services. | Australia | 2026-09-29 |
| [Box](https://thirdpartyindex.com/vendors/box.md) | File transfer | USA | 2026-09-29 |
| [BrainTrust Data, Inc.](https://thirdpartyindex.com/vendors/braintrust.md) | AI tool that monitors and evaluates model outputs | Ireland; USA | 2026-09-29 |
| [Census](https://thirdpartyindex.com/vendors/census.md) | Pipeline data processing provider | USA | 2026-09-29 |
| Chorus by ZoomInfo | Customer support communication | USA | 2026-09-29 |
| [Cloudflare](https://thirdpartyindex.com/vendors/cloudflare.md) | Antivirus | USA | 2026-09-29 |
| Confluent Cloud | Event streaming and logging | USA | 2026-09-29 |
| [ConvertIO](https://thirdpartyindex.com/vendors/convertio.md) | Online service for securely converting files between file formats. | Cyprus | 2026-09-29 |
| [Datadog](https://thirdpartyindex.com/vendors/datadog.md) | Infrastructure and error monitoring service for cloud-based applications. | USA | 2026-09-29 |
| DigitalBrain | Customer support communication | USA | 2026-09-29 |
| [DocuSign](https://thirdpartyindex.com/vendors/docusign.md) | Electronic signing of documents. | USA | 2026-09-29 |
| [Fivetran](https://thirdpartyindex.com/vendors/fivetran.md) | Pipeline data processing provider | USA | 2026-09-29 |
| Forethought.ai | Customer support communication | USA | 2026-09-29 |
| [Front](https://thirdpartyindex.com/vendors/front.md) | Customer support communication | USA | 2026-09-29 |
| [FullStory](https://thirdpartyindex.com/vendors/fullstory.md) | Product analytics platform used when developing new features and services. It stores user contact details, product usage recordings and product usage analytics. | USA | 2026-09-29 |
| [Global Relay](https://thirdpartyindex.com/vendors/global-relay.md) | Data archiving for compliance | USA | 2026-09-29 |
| [Google Cloud Platform](https://thirdpartyindex.com/vendors/google-cloud.md) | Data analysis and cloud infrastructure | USA | 2026-09-29 |
| [Hex Technologies, Inc.](https://thirdpartyindex.com/vendors/hex.md) | Data platform for data science and analytics | USA | 2026-09-29 |
| Infinit-O Global, Limited | Professional service outsourcing services | Phillipines | 2026-09-29 |
| [Intercom](https://thirdpartyindex.com/vendors/intercom.md) | User support and engagement platform used to display content in the product. It stores user contact details and product interaction data. | Ireland | 2026-09-29 |
| [Iterable](https://thirdpartyindex.com/vendors/iterable.md) | Client and marketing email automation | USA | 2026-09-29 |
| Johnston Carmichael LLP | Tax Services | UK | 2026-09-29 |
| [LexisNexis](https://thirdpartyindex.com/vendors/lexisnexis.md) | BSA/AML and KYC screening | USA | 2026-09-29 |
| Lob.com | Mail and address verification automation | USA | 2026-09-29 |
| [Looker](https://thirdpartyindex.com/vendors/looker.md) | Business intelligence | USA | 2026-09-29 |
| Lumopath, Inc. | Communication and collaboration analytics | USA | 2026-09-29 |
| [Mailchimp](https://thirdpartyindex.com/vendors/mailchimp.md) | Client and marketing email automation | USA | 2026-09-29 |
| [Marketo](https://thirdpartyindex.com/vendors/marketo.md) | Marketing | USA | 2026-09-29 |
| [Mixmax](https://thirdpartyindex.com/vendors/mixmax.md) | Scheduling and email automation | USA | 2026-09-29 |
| Notion | Provides a cloud-based internal collaboration system, much like an intranet, where we may reference customer data as necessary to deliver and improve the Carta Europe services. | USA | 2026-09-29 |
| [OpenAI](https://thirdpartyindex.com/vendors/openai.md) | Service Provider for AI Functions | USA | 2026-09-29 |
| Patrina Corporation | Data and records archiving | USA | 2026-09-29 |
| [Pendo](https://thirdpartyindex.com/vendors/pendo.md) | User data analytics | USA | 2026-09-29 |
| Plaid Inc. | Bank integration | USA | 2026-09-29 |
| [Salesforce](https://thirdpartyindex.com/vendors/salesforce.md) | Client relationship management | USA | 2026-09-29 |
| Salesforce.com EMEA Limited | Provides us with a cloud application platform (Heroku) for running the Application and leveraging platform extensions for error analysis, mail sending, and more. | UK, EU and USA | 2026-09-29 |
| [SendSafely](https://thirdpartyindex.com/vendors/sendsafely.md) | File encryption service. | USA | 2026-09-29 |
| [Sentry](https://thirdpartyindex.com/vendors/sentry.md) | Cloud-based application and error monitoring platform. | USA | 2026-09-29 |
| [Slack](https://thirdpartyindex.com/vendors/slack.md) | Communication and collaboration | USA | 2026-09-29 |
| [Snowflake](https://thirdpartyindex.com/vendors/snowflake.md) | Data warehouse; Provides a cloud data warehouse to store and transform data for use in business analytics. | Ireland and USA; USA | 2026-09-29 |
| [Stripe](https://thirdpartyindex.com/vendors/stripe.md) | Money movement and account verification | USA | 2026-09-29 |
| Sutro Labs Inc. d/b/a/ Census | Provides data integration services. | USA | 2026-09-29 |
| Thomson Reuters | Identity management system to fulfill KYC/AML and customer identification requirements | USA | 2026-09-29 |
| [Twilio](https://thirdpartyindex.com/vendors/twilio.md) | Platform for text messages used for 2FA and for transactional emails (via the Twilio company SendGrid). | USA | 2026-09-29 |
| [Typeform, S.L.](https://thirdpartyindex.com/vendors/typeform.md) | Online form building tool for collecting user feedback in online surveys. It stores user identifications and anonymised user feedback. | Spain | 2026-09-29 |
| [Workato](https://thirdpartyindex.com/vendors/workato.md) | Workflow automation | USA | 2026-09-29 |

Read from ([evidence](https://thirdpartyindex.com/evidence/17186)). CSV: https://thirdpartyindex.com/vendors/carta/subprocessors.csv

## Compliance

As its trust center lists them.

- Audited: SOC 1 Type II, SOC 2 Type II, ISO/IEC 27001 ([evidence](https://thirdpartyindex.com/evidence/17184))
- Claimed: GDPR, CCPA/CPRA ([evidence](https://thirdpartyindex.com/evidence/17184))

## Listed as a subprocessor by (0)

No tracked vendor lists it.

## Service status

Incidents it reported on its own status page.

- Last 90 days: 4 reported incidents (2 major or critical, 0 minor, 2 with no impact stated)
- Typical time to resolve: 1 h 51 min
- 2026-09-23: Partial Site Outage (major)
- 2026-09-01: Email delivery degraded (no impact stated)
- 2026-07-16: SSO login errors (major)
- 2026-07-06: Intermittent slowness (no impact stated)
- 2026-05-27: Elevated errors (minor)
- 2026-03-31: Loan Operations (no impact stated)
- 2026-03-19: Degraded performance on Android mobile app (major)
- 2025-11-24: Degraded performance (minor)

---

Third Party Index (https://thirdpartyindex.com) monitors vendors' public security and privacy documents and keeps each version as evidence. Data CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/); vendors' own documents are theirs. API: https://thirdpartyindex.com/api