This page is for the people doing due diligence on CART - security, IT, and technical teams evaluating us before a deployment. For product details, see the product overview.
For the full breakdown of who's responsible for what, consent capture, TCPA, and carrier compliance, see Consent & Compliance.
CART runs on load-balanced, autoscaling infrastructure with failover contingencies built in. SalesLead.ai does not guarantee uninterrupted availability and makes commercially reasonable efforts to maintain system uptime, consistent with the Master Services Agreement.
CART reads cart, checkout, and customer contact data from your store to run SMS conversations. It does not access unrelated store data, financial account details, or admin-level settings. Customer Winback can also start from a customer file or Klaviyo export, with no store connection required.
CART requests only the access it needs. It reads orders, customers, products, and inventory, and it writes back one thing: a customer's SMS consent status, so an opt-out is respected everywhere. It never creates, modifies, or deletes orders, products, or inventory.
Your Shopify access token is encrypted at rest and only decrypted server-side when CART needs to fetch checkout data. It is never exposed to client-side code.
CART checks for new abandoned checkouts every 15 minutes. Once a checkout is detected, the Supabase real-time data layer keeps that cart's state and message history in sync for the rest of the conversation.
Underlying data processing and storage follow Supabase's own infrastructure and security posture, since that is the platform CART is built on.
How a recovered checkout or a won-back customer moves through the system, end to end.
Store access is limited to what CART needs, credentials are encrypted, and orders sync on a 15-minute polling cycle. For Customer Winback, the records we text are cleaned and matched against your opt-out list before any message is sent.
SalesLead.ai engages the following subprocessors to deliver the Services:
This list reflects current subprocessors as of the date below. Contact us for the most current list or to be notified of changes.
Last updated: August 18, 2026
Client data is retained only as long as necessary to provide the Services and meet legal, regulatory, and contractual obligations. Upon termination, clients may request access to their data within 30 days; after that window, SalesLead.ai may delete client data unless retention is required by law.
If SalesLead.ai becomes aware of a security incident affecting client data, we will notify affected clients without undue delay, and in any case within the timeframe required by applicable law. Notification will include the nature of the incident, the data affected, and the steps taken to address it, to the extent known at the time.
Before your free trial begins, you accept our short trial terms in one step. They cover consent, carrier registration under your brand, and how we process your customer data. A Master Services Agreement and Data Processing Agreement are signed when you move to paid credits.
If your team needs a completed security questionnaire, a call with someone technical, or documentation beyond what's here, reach out directly.
Contact us →