Security
The most sensitive things a client sends anyone, kept the way you would keep them.
Here are the high points. Every one is a property of the system, not an intention, and the full practices say what we do not claim as well.
- Encryption
- In transit and at rest
- Encryption key
- Managed by us
- Held in
- One United States region
- Used to train AI
- Never
- Sold or shared for ads
- Never
- Audit log
- Cannot be edited
- Incident notice
- Within 72 hours
Storage
How documents are held
Statements, returns and IDs are kept apart from everything else, and from every other firm.
Encrypted, and kept in the US
Documents are encrypted in transit and at rest, under a key we manage ourselves. They are stored in a single United States region. None is ever served from a public address; every download checks who is asking.
Every firm walled off
Your clients can never appear in another firm’s account. A record that cannot say which firm it belongs to does not load at all.
Scanned before anyone opens it
A document uploaded into our storage is withheld until its scan comes back clean, and a scan that failed is never treated as one that passed.
Kept until you say otherwise
Nothing is deleted by default. Set a retention window and you are emailed before anything goes. When it expires, documents are permanently deleted, not hidden. Files you keep in a client vault stay until you remove them.
Access
Who can reach them
Your team, as far as each person’s role allows, and nobody on a password alone if you say so.
Two-factor sign-in and passkeys
Available on every account. Or sign in with Google or Microsoft. Require two-factor for everyone in your firm, and nobody reaches a client’s documents on a password alone.
Roles that fit your team
Owners, admins and members, or roles of your own, so a paraplanner can work the inbox without being able to export it.
Social Security numbers kept apart
Stored encrypted and shown as the last four digits. Only the people you allow can see the whole number, only after confirming their password, and every look is logged.
Several people, each their own part
When a client’s CPA or spouse answers part of a request, each has their own link and sees only their own part, enforced on every page their link reaches. A person asked to sign reads the whole reply first.
Links you can take back
Cancel a single client’s request without disturbing anyone else mid-upload. Links can expire, and a page holding a client’s documents is never indexed.
Evidence
What is on the record
What happened in your workspace is written down where nobody can rewrite it.
A log nobody can edit
Every time a document is opened, downloaded or exported, it is recorded, and nobody, us included, can change or delete that record.
A record of every signing
When the code was sent, when the client agreed and when they signed, in a log where a changed or missing entry shows, dated by an independent timestamping authority.
No trackers, no advertising
No analytics vendor and no advertising network on any page. Where a firm enters its card, the number goes straight to Stripe and never passes through us.
How documents are read
Read by AI that never learns from them
Inside our own AWS account
Documents are read by Claude models running on Amazon Bedrock, in United States regions only. The model’s maker never receives the document at all.
Nothing kept, nothing trained on
Bedrock keeps neither the document nor the answer once it has been read, and nothing a client sends is used to train a model.
Yours to turn off
A firm can turn reading off. What is kept is the result, in your own workspace, under your retention setting.
For your vendor review
What a Reg S-P or Safeguards Rule review needs from us
- What we hold
- What your clients send through your forms, the contact details you enter for them, and the record of what happened to each. Nothing else about them.
- If something goes wrong
- If your clients’ information is reached by someone who should not have it, we tell you within 72 hours. Our data processing addendum commits us to it.
- Every company named
- Each company that can reach a document is on the subprocessors page.
- The platform underneath
- The application runs on Laravel Cloud, which holds a SOC 2 Type 2 attestation and an ISO 27001 certification. Those are theirs, not ours.
What we do not claim
We hold no SOC 2 report, no ISO 27001 certification and no PCI attestation, and we are not a HIPAA business associate. A vendor’s certification is not its customers’, and we would rather say so plainly than let a questionnaire read one as the other.
There is no uptime commitment in our terms either, because there is nothing measuring one yet.
Found a problem? Write to security@cartenda.com. We will not pursue anyone who reports a vulnerability in good faith and gives us a reasonable chance to fix it before saying so publicly.
See it with one of your own clients
Start from the onboarding form, send it to a client you trust to tell you what they think, and watch what comes back.