Security
How Carrot Labs AI, Inc. protects SuperPenguin customer data.
Last updated:
Security overview
SuperPenguin is an AI cost management and engineering analytics platform operated by Carrot Labs AI, Inc.. We design the product so teams can measure and attribute AI usage without sending prompts, source code, or provider credentials to our servers by default.
This page covers our dashboard, provider billing and usage sync, SDK telemetry, SuperPenguin Desktop, integrations, and optional content and AI features. For a description of the personal data we process and the choices available to customers and individuals, see our Privacy Policy.
Security questions or concerns? Email us at [email protected].
SOC 2 and Trust Center
Carrot Labs AI, Inc. is currently undergoing a SOC 2 Type II examination. Our public Vanta Trust Center provides current security-control summaries, our published subprocessor information, and our SOC 2 engagement letter. We will update this page when the examination is complete and a report is available.
Contact us to discuss security questionnaires, data processing terms, and additional diligence materials.
Infrastructure and access controls
SuperPenguin operates separated production and non-production environments. Production customer data is not mixed with local development or hosted staging workloads.
Access to the dashboard requires authentication and is scoped to organizations the user belongs to. Visibility within an organization depends on workspace roles, feature-specific permissions, and customer configuration.
Administrative access to production applications, databases, networks, and encryption keys is restricted to authorized personnel with a business need. Personnel use unique accounts, complete security-awareness training, and are subject to confidentiality obligations and applicable background checks. Access is removed through our offboarding process when employment or responsibilities change.
Encryption and credentials
Data in transit between supported clients, our services, and connected providers is protected with TLS.
Provider and integration credentials stored for billing, usage, or notification sync are encrypted at rest using AES-256-GCM. Opt-in captured prompts and outcomes are encrypted with the same authenticated-encryption standard. Our application encryption supports versioned keys so encrypted records can be re-encrypted during key rotation.
SuperPenguin SDK API keys are stored as one-way hashes; we do not retain their plaintext value after creation. We use stored integration credentials only for the operations customers authorize. Disconnecting an integration removes its credentials from active systems; residual copies may remain temporarily in protected backups until those backups expire under our retention procedures.
SuperPenguin Desktop
SuperPenguin Desktop reads local usage artifacts from supported AI coding tools, including Cursor, Claude Code, and Codex. By default, it uploads content-free usage and attribution metadata such as:
- Tool, model, token, request, timing, and session identifiers
- Workspace, repository, remote, and branch identifiers, which may include local workspace paths reported by the tool
- Relative file paths, aggregate edit statistics, commit hashes, and pull-request evidence
- Configuration metadata such as rule filenames, skill and MCP server names, tool-call counts, and configuration token counts
- Data-quality and provenance fields and API-equivalent cost estimates
By default, Desktop does not upload:
- Source file contents
- Prompts or model responses
- Tool arguments or tool outputs
- Environment-variable values
- Provider API keys, OAuth tokens, cookies, or raw usage responses
Where a coding tool requires a local credential to retrieve usage limits, that credential remains local: SuperPenguin does not refresh it, store it on our servers, or include it in an upload. Desktop authenticates to SuperPenguin through a system-browser OAuth flow using Authorization Code with PKCE and receives a revocable installation credential. Organization membership is checked when the installation accesses server data.
Our official macOS release configuration uses Apple Developer ID signing, notarization, and the hardened runtime. Desktop updates are accepted only from the configured release source and verify the downloaded artifact against its SHA-256 digest when the update manifest provides one.
SDK security
The SuperPenguin SDK wraps existing provider client libraries. Model inference requests go directly from the customer application to the selected AI provider; SuperPenguin does not proxy that LLM traffic.
Your SuperPenguin API key (SP_API_KEY) is intended for server-side use only and should not be embedded in browser bundles or other public client code.
By default, SDK telemetry records cost metadata only:
- AI provider and model name
- Input, output, reasoning, and cache token counts when available
- Estimated cost and request latency
- Attribution tags supplied by the customer, such as customer, feature, team, environment, or prompt identifiers
By default, the SDK does not collect prompts, model responses, images, audio, tool arguments, or provider API keys. SDK content capture is a separate organization-controlled feature described below.
Optional content and AI features
The controls below are separate. Enabling one does not automatically enable the others.
SDK content capture
Eligible organizations may opt in to sampled capture of text prompts and outcomes for offline analysis. This is off by default. When enabled, SuperPenguin strips images and audio, applies built-in redaction rules, encrypts captured content at rest, and lets organization owners delete captured content from Settings.
Desktop prompt storage
Each member may separately choose to store redacted prompt text from supported coding tools. Prompt storage is off by default, prompt records are encrypted at rest, and disabling storage deletes that member's stored prompt records. Session titles derived from prompt content are stored only while this permission allows it.
Semantic matching and remote analysis
Deterministic matching can attribute sessions using content-free repository, branch, commit, and pull-request evidence. Optional semantic matching is controlled separately. Semantic inputs leave the device for hosted model processing only when the member also enables remote semantic analysis.
Usage-limit sharing
Members may share current normalized coding-tool allowance information with their organization, including percentages, reset times, pace, freshness, and reporting status. Provider credentials, prompts, code, raw provider responses, and provider account emails are not included. Depending on the customer's plan and policy, sharing may be the member's choice or may be required by the organization after an in-product disclosure and acknowledgment.
Session Analyze
Session Analyze is user-initiated. When used, bounded transcript previews and structured session signals are sent to a hosted model service to categorize the selected session. This processing is separate from stored-prompt and semantic-matching preferences.
Ask SuperPenguin
When a user starts an assistant conversation, SuperPenguin sends the chat message, relevant conversation history, selected product documentation, and limited account context to a hosted model service to generate a response. Conversation history is stored to provide the feature. Assistant telemetry remains metadata-only and is not routed through SDK content capture.
Customers are responsible for providing workplace and end-user notices and obtaining any consent required by law before enabling organization-controlled content or employee-monitoring features.
Secure development
We maintain software-development lifecycle, change-management, and configuration-management procedures. Application and database changes are validated in a separated staging environment before production deployment.
Engineering safeguards include:
- Code review and version-controlled change history
- Strict TypeScript checking and ESLint
- Automated tests, pricing validation, and schema validation
- Versioned and reviewable database migrations
- Policies and tooling intended to prevent committed secrets
- Vulnerability-management and system-monitoring procedures
- Periodic security-control self-assessments
Business continuity
We maintain documented backup, business-continuity, and disaster-recovery procedures. Our continuity and recovery plans are tested at least annually. Specific recovery objectives, contractual availability commitments, and diligence evidence are provided in applicable customer agreements or on request.
Privacy and data controls
Our Privacy Policy describes the data we collect, how we use and disclose it, and the choices available to customers and individuals. We do not sell personal information or use it for cross-context behavioral advertising.
Workspace data is visible according to organization membership, roles, feature-specific permissions, and customer settings. Content and hosted-AI features have separate controls as described above. Claude Code coverage is classified on the member's Mac from a bounded local history. Historical percentages, reset times, account fingerprints, credential values, and extra-usage dollar amounts are not uploaded with the derived coverage category. On Team workspaces, that derived category follows the workspace's required or member-selected limit-sharing policy. Current control and subprocessor information is available through our Trust Center.
Account and data deletion
You may request access, correction, export, or deletion of your personal data by emailing [email protected]. We respond to verified privacy requests within 30 days unless a longer period is permitted by applicable law.
Disconnecting an integration removes its credentials from active systems. Disabling Desktop prompt storage deletes that member's stored prompt records, and organization owners can delete SDK captured content from Settings. Other account, organization, and telemetry data is retained and deleted as described in our Privacy Policy, customer agreements, and legal retention requirements.
Incident response and communication
We maintain procedures to investigate, contain, remediate, and learn from security and availability incidents. We notify affected customer contacts about confirmed security incidents as required by applicable law and customer agreements.
Customer-visible availability notices are posted on our system status page. Security concerns should be reported directly to [email protected].
Vulnerability disclosures
If you believe you have found a vulnerability in SuperPenguin, report it to [email protected] with a description, reproducible steps, affected components, and the potential impact.
Please avoid accessing, modifying, retaining, or destroying data that is not your own; disrupting service; performing denial-of- service or social-engineering tests; or publicly disclosing the issue before we have had a reasonable opportunity to investigate. We acknowledge and triage reports and prioritize remediation based on severity and exploitability.