Most file-sharing advice quietly assumes the file is a design mockup. Contracts, medical records, payroll data and identity documents deserve different handling, and the difference is mostly about controls rather than cryptography.
Stop emailing attachments
An emailed attachment is the worst available option for sensitive material, and it is the default nearly everywhere.
It is copied permanently into every recipient’s mailbox, plus your sent folder, plus every backup of both. It cannot be revoked, corrected or expired. It gets forwarded to people you never chose, often inside a longer thread nobody re-reads before hitting reply-all. And it persists in mail archives long after the matter is closed and everyone involved has moved on.
The autocomplete misfire - typing three letters and selecting the wrong person - is not hypothetical. It is the single most common way documents reach people they should not.
A ladder of controls
Pick the lowest rung that genuinely fits. Every additional control is a step where a legitimate recipient gets stuck and emails you instead, which is how people end up abandoning the secure route entirely.
A link with an expiry. The baseline for anything. Access ends on a date you chose rather than continuing indefinitely by default. Suitable for routine business documents, and the habit worth making automatic - the reasoning is here.
A password on the link. Sent by a different channel from the link itself - otherwise it is theatre, because anyone receiving the forwarded message has both halves. Handles casual forwarding, and works for recipients with no account who cannot reasonably be asked to create one. See when passwords help.
Restricted to named email addresses. Access is tied to identity rather than a shared secret, so there is nothing to leak onward and the record shows which person opened what. This is the right default for anything with legal, financial or personal-data consequences.
End-to-end encryption. The key is derived on your device, so what is stored is ciphertext. The trade-offs are real and worth reading before choosing it - no server-side previews or search, no protocol access, and no recovery if you lose your key material. What zero-knowledge actually means covers them properly.
Things that are not controls
Renaming the file. document-final-v3.pdf protects nothing from anyone who
has it.
A “confidential” watermark. Genuinely useful for discouraging casual redistribution and for establishing provenance if a document leaks. It stops nobody who is determined, and should never be mistaken for access control.
A password on the PDF itself. Better than nothing, frequently weak depending on the tool that applied it, and it fails in the same way as any password sent alongside the file.
Sending it “just to one person”. Recipients forward things. That is what recipients do.
Practical habits
Share the narrowest thing that answers the question. A single page rather than the whole file. A redacted version rather than the original. A summary rather than the underlying data. Most sensitive-document incidents involve material the recipient never needed.
Set the expiry at the moment of sharing. That is the only point at which you genuinely know how long it should live, because you are thinking about the project, the recipient and the deadline simultaneously. Nobody comes back later to tidy up.
Check the recipient address before sending. Autocomplete is the most reliable adversary you will face this year.
Prefer sending a request over sending a file when you need documents from someone. An upload page they can use without an account avoids them emailing you their passport scan as an attachment, which is otherwise exactly what happens.
Review external access occasionally. Not because a policy demands it, but because the people who would notice a stale share are usually the ones who have left the project.
Matching the rung to the document
A rough mapping, to save deciding from first principles each time:
| Document | Control |
|---|---|
| Proposal, quote, general correspondence | Link with expiry |
| Signed contract | Link, expiry, password |
| Invoice with bank details | Restricted to named addresses |
| Payroll or HR records | Restricted, short expiry, logged |
| Medical or health information | Restricted, and consider end-to-end |
| Passport or ID scan | Restricted, shortest workable expiry |
| Unreleased or embargoed work | Restricted, expiry at the embargo date |
| Published report, portfolio | Open link, no expiry, deliberately |
The pattern: the more a leak would hurt somebody other than you, the further up the ladder you go. That is a better test than how confidential the document feels, because your own embarrassment is a poor proxy for someone else’s exposure.
Personal data has extra obligations
If a document contains personal data about someone else, most data protection regimes expect you to keep it no longer than necessary and to be able to say who has access.
A share link with no expiry, granted to an address nobody tracks, satisfies neither. Not because a regulator is likely to appear, but because if one ever asks, “I don’t know how long that was accessible” is the answer you cannot give.
Keep a record
For anything with a compliance dimension, being able to answer “who accessed this and when” months later matters as much as the controls themselves. Controls express intent; the log is what demonstrates the intent held.
Our guide to what a file audit log should record covers what makes a trail worth having - in particular why denied attempts are more informative than successful ones, and why the retention window matters more than the feature existing at all.
