How CART handles security, compliance, and how it's built.

Compliance framework

• SOC 2 Type II - CART runs on Supabase infrastructure, which maintains SOC 2 Type II compliance. SalesLead.ai does not hold a separate SOC 2 report; this attribution reflects the underlying infrastructure vendor.
• A2P 10DLC carrier registration - SalesLead.ai manages carrier registration and SMS operations for every deployment, operating within its own TCPA-aligned compliance framework. CART sends from local, dedicated 10DLC numbers rather than toll-free. It takes longer to register, but it's what lets the number read as a real, direct conversation instead of a notification line.
• Consent and opt-out - Messages include opt-out instructions consistent with TCPA and carrier requirements. Replying STOP immediately and permanently suppresses future messages to that number.
• AI disclosure - If a shopper asks whether they're speaking with a person or an AI, CART discloses that clearly and immediately.

Availability

CART runs on load-balanced, autoscaling infrastructure with failover contingencies built in. SalesLead.ai does not guarantee uninterrupted availability and makes commercially reasonable efforts to maintain system uptime, consistent with the Master Services Agreement.

Data handling

CART reads cart, checkout, and customer contact data from your Shopify store to run SMS conversations. It does not access unrelated store data, financial account details, or admin-level settings.

Access is read-only. The Shopify integration requests only read_orders, read_customers, read_products, and read_inventory scopes, nothing that creates, modifies, or deletes data in your store.

Your Shopify access token is encrypted at rest and only decrypted server-side when CART needs to fetch checkout data. It is never exposed to client-side code.

CART checks for new abandoned checkouts every 15 minutes. Once a checkout is detected, the Supabase real-time data layer keeps that cart's state and message history in sync for the rest of the conversation.

Underlying data processing and storage follow Supabase's own infrastructure and security posture, since that is the platform CART is built on.

Product mechanics

• Duplicate protection - Shoppers are matched by email or phone number. If the same customer abandons multiple carts, their existing record is updated rather than duplicated.
• Recovery links - Each abandoned cart gets a unique recovery link that restores the shopper's cart contents, so returning to checkout doesn't mean rebuilding the order from scratch.

Architecture

How a recovered checkout actually moves through the system, end to end.

Every box in this diagram is a real system boundary, not a simplification. Read-only Shopify access, encrypted credentials, and the 15-minute polling cadence are documented above.

Subprocessors

SalesLead.ai engages the following subprocessors to deliver the Services:

• Agentum Solutions LLC (affiliate of SalesLead.ai) - AI infrastructure development, operations, and technical delivery
• Supabase - data infrastructure and database hosting
• HighLevel - orchestration and pipeline tracking
• OpenAI - AI language model processing for conversational message generation
• Twilio - SMS message transmission and carrier connectivity
• Stripe - payment processing for SalesLead.ai's billing of client accounts. Stripe does not process your customers' checkout or payment data, that stays in Shopify.

This list reflects current subprocessors as of the date below. Contact us for the most current list or to be notified of changes.

Last updated: July 31, 2026

Data retention

Client data is retained only as long as necessary to provide the Services and meet legal, regulatory, and contractual obligations. Upon termination, clients may request access to their data within 30 days; after that window, SalesLead.ai may delete client data unless retention is required by law.

Security incident notification

If SalesLead.ai becomes aware of a security incident affecting client data, we will notify affected clients without undue delay, and in any case within the timeframe required by applicable law. Notification will include the nature of the incident, the data affected, and the steps taken to address it, to the extent known at the time.

Agreements

A Master Services Agreement and Data Processing Agreement are required for every CART deployment, including the Revenue Proof trial. Contact us to put these in place before your trial begins.