Ask a customer for a secret

When a customer needs to send us something sensitive — a password, an account number, a key file — don't have them email it. Send them a request link instead: they get a page where the secret is encrypted in their own browser, and only you can read the reply. Creating a request requires an InternalCars sign-in; the customer needs nothing but the link.

Create a request

Step by step

Open Request a secret and pick how long the link lasts. The window covers both sides: the customer must send within it, and you must read what they sent within the same window.
Hit Create request link. You get two links:
- Send this to them — the request link the customer opens to send you the secret.
- Keep this for yourself — your inbox link, the only thing that can read the reply.
Send the customer the first link only.
Once they've sent the secret, open your inbox link. "Nothing sent yet" means check back later; "A secret is waiting" means you can collect it.
Click Retrieve and destroy. Like revealing a note, this is one-time: have a safe place ready (a password manager, not a chat message to yourself) before you click.

Never send both links together

Anyone holding both links can read the reply. The request link alone can only be used to send — that's the whole design — so the inbox link is the one to guard.

Why two links?

The request link carries a lock; the inbox link carries the only key that opens it. (Technically: a fresh public/private key pair your browser generates — see security.) The customer's browser encrypts with the lock from their link, so even someone who intercepts the request link can send you things, but can never read what the customer sent.

Worth knowing

There is no dashboard of your open requests — deliberately, we don't record who created what. The inbox link is your only way back in, so keep it the way you'd keep a note's manage link.
If the customer set a passphrase, they must tell you separately; you'll be asked to unlock with it when you retrieve.
One request accepts exactly one submission. If the customer has more to send, create another request.
If the window expires before you retrieve, what they sent is purged along with the request. Create a new one and ask again.

Next: what the customer sees.