Your data: what is held, where, and how it leaves.

What Cargovate stores

Operational records: consignments and their movements, the parties involved, checkpoints and the evidence attached to them, documents you attach, or only the fingerprint of a document you keep in your own store, purchase orders you import, and — where you license those capabilities — stock, assets and telemetry.

Your own identifiers are kept verbatim. A shipment you call JOB-4417 stays JOB-4417 throughout, rather than being replaced by a number of ours that your staff then have to translate. This matters more than it sounds: it is the difference between your people searching the way they already think and learning a second vocabulary.

How your records stay yours

Every record carries the organization it belongs to. For operational records (shipments, custody, documents, stock, orders and the rest) that boundary is enforced by the database itself rather than by application code remembering to filter, so a defect in a feature cannot leak another organization's records: a query that forgets to scope returns nothing, rather than returning everything. Accounts, sign-in sessions, keys and billing are looked up before an organization is known, so the application keeps those apart. On a dedicated or self-hosted deployment, the database is yours alone.

Where you deliberately grant access — a freight forwarder acting for you — that grant is explicit, recorded, and revocable by you at any time. It is not a shared login, and every action taken under it remains attributed to the person who really performed it.

Where it physically lives

In our managed cloud, the database is in the European Union (Finland), and secure connections end at our gateway in France, where access logs are also written; a dedicated instance runs in another region if your records must be held there. On your own estate, wherever you put it — including a machine with no route to the internet at all. The server does not require an outbound connection to function; see Deployment.

Getting it all back

Your organization's owners and administrators can export all of it from within the product, whenever they like, including while an account is read-only: every record as one JSON file, any table as CSV, and every uploaded document as one ZIP with a manifest of each file's SHA-256 fingerprint and what it is attached to. Passwords, access keys and other credentials are left out. If you cannot export it yourselves, ask us and we will provide a complete copy, with no proprietary container and no professional-services engagement to read your own history. On a self-hosted deployment the database is yours already, and a standard backup restores into a plain PostgreSQL instance.

We would rather say this plainly than be asked. A platform that makes leaving expensive earns renewals from friction instead of value, and the customers worth having can tell the difference.

Removal

On request we remove your organization and the operational records belonging to it. Records we are separately required to retain — a signed audit trail under a regulation you operate within — are named at the time rather than quietly kept, so what remains and why is written down before anything is deleted.