Security at Karta

Security leadership

Jorge G. Cruz

Designated Security Officer

Leads Karta's information security program, including vulnerability management and incident response.

Report a vulnerability

If you believe you have found a security vulnerability in a Karta website, mobile app or API, email it to:

Please include:

• A description of the issue and where it occurs (URL, app screen or API endpoint).
• The steps needed to reproduce it.
• The impact you believe it has.

We review every report and will reply to let you know the next steps. Karta does not run a paid bug bounty program at this time.

While you investigate

• Use only accounts you own. Do not access, change or keep other people's data. If you reach it by accident, stop and tell us in your report.
• Do not run denial-of-service tests, high-volume automated scans or anything else that degrades our services.
• Do not use social engineering, phishing or physical attacks against Karta staff, cardholders or partners.
• Give us reasonable time to fix the issue before you disclose it publicly.

Card or account issues

The address above is only for security vulnerabilities. For a lost or stolen card, a transaction you don't recognize or any other account question, contact Karta support.