Security & Privacy

How Karg handles your data

Here is the plain-English version: how your data is isolated, who can access it, how long links last, and what we do and do not claim. Worth a read before you upload anything.

01 · Isolation

Your data is isolated

Each organization's data is separated from every other organization's data.

• Isolation is enforced at the database level by row-level security, not only in application code.
• An automated cross-tenant test suite checks that one organization cannot read another organization's data.

02 · Access

Access controls

Only signed-in users in your organization can reach your data.

• Access requires signing in.
• Data moves between your browser and Karg over an encrypted connection (HTTPS).
• High-cost and abuse-prone actions are rate-limited to deter misuse.

03 · Data handling

How your data is handled

Karg uses your data only to clean it and show its work.

• Karg works on a copy; your original upload is preserved.
• Most values are resolved by deterministic rules; AI is used only for the genuinely ambiguous minority.
• To resolve values that rules cannot, the relevant values may be sent to our third-party AI layer (DeepSeek v4 Flash and Pro) to generate suggestions.
• We use only AI providers that do not train on your prompts or API data.
• Files are stored in managed cloud infrastructure with access controls.
• Karg does not sell your data or share it with third parties for advertising.

04 · Retention

Retention

You stay in control of your runs, and download links are short-lived.

• Download links expire after a short window, so a shared or stale link stops working.
• You can delete a run, which removes the run and its records (transformations, review items, and artifact references) from your workspace.
• A formal data-retention and deletion policy is still being finalized, and this page will be updated as it is.

05 · Export and audit

Export and audit

Your results are yours to take with you, with a full record of every change.

• Export your cleaned data as your original format, CSV, XLSX, or JSON.
• Every change is recorded in an audit log with the column, what changed, and why.
• Nothing is changed silently; uncertain values are sent to human review instead of being guessed.

06 · Compliance

What we do not claim

We would rather be accurate than impressive.

• Karg does not currently hold SOC 2, HIPAA, or other certifications.
• Please do not upload data that requires those certifications until formal compliance is in place.
• If you have a specific security or compliance question, contact us before uploading.

Try Karg on your own data.

Request early access and see exactly how your data is handled, start to finish.