Is this link safe?

It is sensible to be careful with any link that asks for personal details. This article explains how to tell a real request from a firm you work with from a fake, and how what you send is protected.

If you were not expecting it, check first#

The safest check is simple: contact the firm using a phone number or email you already have for them. Use a number from a letter, a statement or their website that you looked up yourself. Do not use a number or address from the message you just received. Ask them whether they sent you a request.

What a real request looks like#

The firm that sent you the form uses a service called Cartenda to send forms and collect documents. A real request:

• Names the firm. The email comes in the firm's name, usually with the subject "[Firm name] has requested your documents". A text always names the firm near the start.
• Tells you to check if you were not expecting it. Every request email ends by telling you to check with the firm using contact details you already have. Every request text says to call the firm, and that you can reply STOP.

• Links to cartenda.com. Before you tap, check that the link goes to an address starting with https://cartenda.com/. When the page opens, check the address bar shows cartenda.com and a padlock.
• Never asks you to make an account or a password. There is nothing to sign up for. The one place you sign in is the firm's page for your record with them, and it asks only for your email address and a code it emails you. If a page asks for a password to see your documents, stop and call the firm.

The form itself shows the firm's name, and their logo if they have added one. The bottom of every form page says "Sent securely to" and the firm's name, with a link to How your documents are handled. The page for your record with the firm says "Private to you and" the firm's name instead. If the firm has given a phone number or email, it is there too, and there is a link to report a problem with the form if something does not work. Most firms also leave a small "Powered by Cartenda" line under it.

About codes#

If the form asks you to sign, or the firm sends you files, you may be sent a short code by email or text to confirm it is you. The code works for a few minutes only.

Never read a code out or send it to anyone, even someone who says they are from the firm or from Cartenda. You only ever type it into the page you have open. If you get a code you did not ask for, you can ignore it.

How your documents are protected#

• Only the firm receives what you send. Nothing reaches them until you press send.
• It is encrypted. Your answers and documents are encrypted while they travel and while they are stored. Documents are stored in the United States.
• Every time someone opens a document, it is recorded. Each time anyone opens one of your documents through Cartenda, it is written to a record the firm can read and nobody can change.
• Sensitive numbers are protected. Social Security numbers and account numbers entered in their own boxes are stored encrypted and shown masked.
• It is not used to train AI. Unless the firm has turned it off, your documents are read by software so the firm can see what arrived and pull out the figures they need. If you answer in Spanish, your answers are also translated into English for the firm, and what you wrote is kept as you wrote it. This is done by Claude models on Amazon Bedrock, in the United States. Nothing you send is used to train a model. If the firm's form has an Ask about your form assistant, what you ask it goes the same way, and it is not kept.
• It is not sold or used for advertising. The page does not track you, and search engines do not list it.

How long your documents are kept is up to the firm. For the full details, open How your documents are handled at the bottom of the form.

If something seems wrong#

If you think a message is fake, do not tap the link. Contact the firm on a number you already have and tell them what you received.

If you have already entered details into a page you now doubt, contact the firm straight away and tell them what you entered.

Questions about your own documents are best asked of the firm. For questions about Cartenda itself, write to hello@cartenda.com.