Where your data lives

Your clients trust you with their statements, returns and IDs. This article explains where those documents are stored, how they're protected, and what happens when AI reads them. The public security page and subprocessors list cover the same ground in more detail and are written to hand to a reviewer.

Where documents are stored#

Uploaded documents are held in object storage in Cartenda's own Amazon Web Services account, separate from the application's database. They are:

• encrypted in transit and at rest, with a key Cartenda manages rather than one the storage provider holds on its behalf
• stored in a single United States region, and not replicated outside it
• never served from a public address

Every download goes through Cartenda, which checks who is asking before it hands anything over. Links that do reach storage directly are signed and expire within minutes.

The application, its database and its job queue run on Laravel Cloud, in the United States.

Malware scanning#

A document uploaded into Cartenda's storage is scanned for malware before anyone can open it. It's withheld until the scan comes back clean, and a scan that failed is never treated as one that passed.

How AI reads documents#

Unless your firm turns reading off, each document is read to work out what it is, check it against what you asked for, pull out the figures you need and summarize what arrived. See AI summaries and document reading.

That reading is done by Claude models running on Amazon Bedrock, inside Cartenda's own AWS account, in United States regions only.

• Nothing your clients send is used to train a model. Not by Amazon, not by the model's maker, and not by Cartenda. The data processing addendum commits to this.
• The model's maker never receives the document.
• Bedrock keeps neither the document nor the answer once it has been read. What's kept is the result, in your workspace, under your retention setting.

Turn AI reading off#

If you'd rather no model sees what your clients send:

1. Go to Settings → General.
2. Under Reading documents, turn off Read documents as they arrive and press Save.

Documents then arrive unread, and you review them yourself. Nothing about your plan or price changes. The switch is for people who can change workspace settings: owners and admins, by default.

Who else is involved#

A small number of companies help run Cartenda, and each is named on the subprocessors list:

• Laravel Cloud runs the application and database.
• Amazon Web Services stores documents and runs the models that read them.
• Resend sends email, and receives your clients' replies. Cartenda never emails a document, but a document a client attaches to a reply passes through Resend, which keeps its own copy of the email.
• Sent sends text messages.
• Stripe takes payment from your firm, and never receives anything of your clients'.
• Google suggests an address as one is typed. It receives only what is typed into that field.
• Laravel Nightwatch tells us when the application errors. It receives the technical log, which can say which workspace or submission was involved, but never a client's answers or files.

There's no analytics or advertising company in the product. Your clients' information is never sold or shared for advertising, which the data processing addendum also commits to.

Who inside your firm can reach documents#

Workspaces are isolated from each other, so no other firm can reach yours. Within your firm, what someone can do depends on their role. Reading and working through the inbox is separate from deleting a submission, exporting, and reading the audit log. Every time a client's document is opened through Cartenda, by anyone, it's written to your audit log.

Copies outside Cartenda#

Cartenda is the single place your clients' documents live. Nothing is synced to another service. If your firm connects a drive, a copy goes there only when someone asks, and from then on that copy is your firm's to manage. See Copying documents to your drive.

How long documents are kept#

Documents are kept until your firm's retention window says otherwise. By default, nothing is deleted automatically. See Retention.

Questions from a reviewer#

If your compliance officer or an examiner has questions this doesn't answer, write to hello@cartenda.com.