How to share files securely with clients
Email, links, transfer services and portals compared from both sides of the desk, with a checklist for the moment before you press send.
Autocomplete suggests the other Anna. A link sent in 2023 still opens. The password travels in the same email as the ZIP it is meant to protect. Nobody had to break in for any of this; it was just a busy Tuesday. Sharing files securely with clients is mostly about habits that catch these moments, and about a channel your clients will actually use.
For every file it comes down to the same questions: who can open it, who else can read it on the way and in storage, how long access lasts, and whether you can show later what you sent. The usual channels answer them very differently.
| Channel | Fine for | Watch out for |
|---|---|---|
| Email attachment | Routine documents and small files | Readable on the mail servers along the way; copies stay in every mailbox; one autocompleted address away from the wrong person |
| Password-protected PDF or ZIP | The occasional confidential file by email | Only as strong as the password, which has to travel another way; file names inside a ZIP often stay readable |
| Cloud storage link | Large files and shared folders | Who the link is open to, whether it expires and whether the provider can read the files |
| File transfer service | One-off large deliveries | Anyone with the link can download until it expires |
| Messenger | Quick, informal questions | Business files end up on personal phones, in chat histories nobody can file |
| Client portal or encrypted workspace | Ongoing client work and confidential files | Clients sign in once, so pick one that is easy to join |
If you exchange confidential documents with the same clients all year, a portal or an encrypted workspace is easier to keep safe than email with add-ons. For the occasional file, a well-protected attachment or link can be enough.
On its own, usually not. Most email travels between servers with transport encryption (TLS), which protects the line. But SMTP, the protocol that moves mail, is not an end-to-end mechanism (opens in a new tab): each server along the way decrypts the message, has it in readable form and stores or forwards it. End-to-end encryption with S/MIME or OpenPGP closes that gap, provided both sides have set it up, and many clients haven’t.
I think of plain email as a postcard. An appointment confirmation is fine. A signed contract, a payroll export or a passport copy is not. Whether the GDPR actually requires encryption is a separate question.
Decide how sensitive it is.
Routine paperwork, confidential, or covered by professional secrecy? That decides the channel.
Check the recipient, then check again.
Check the full address, and whether this person should see this document at all: the managing director and the bookkeeper of the same company are not interchangeable. Among its advisable measures, the European Data Protection Board lists (opens in a new tab) switching off address autocomplete and delaying outgoing email briefly, so a message can still be stopped.
Send the key another way.
A password in the same email as the file protects nothing. Phone it through or send a text message.
Give access an end.
Set an expiry date where the tool allows it, and clear out old shares when the matter closes. A folder link also shows every file added later, so share the file itself or a folder that belongs to this client only.
Leave out what they don’t need.
Earlier drafts, unrelated pages and the hidden details inside the file: the author, the device, the place a photo was taken.
Keep a record.
File the version you sent and the client’s confirmation with the matter, so next year’s question has an answer.
The most secure channel protects nothing if your client gives up at the sign-in screen and emails you the passport scan anyway. From the client’s chair, a few things decide it. They want one channel per adviser, not a guessing game about which document came which way. They don’t want another password to remember; a passkey uses the fingerprint, face or PIN that already unlocks their phone. And it has to work on the phone, or the file waits until the weekend.
Then tell clients once, in writing, how you share files and which channels you never use to ask for them. “A document has been shared with you” is a favourite phishing lure, and a client who knows your files always arrive the same way is much harder to fool.
We built Encloq for exactly this exchange, so read this part knowing who wrote it.
- Files and messages are end-to-end encrypted by default, on your device before they leave it. You and the people in the conversation can read them; Encloq can’t.
- You invite a client by email address. Encloq emails the invitation without the access key, which you pass on separately, by phone for example, or as a secure link or QR code that carries it. The guide to guest invitations shows each step.
- An invitation is valid for 30 days and can be revoked at any time. Revoking can’t recall what someone has already received.
- For supported photos, videos, audio, PDFs and Office documents, hidden details such as the author or the location are removed on your device before upload.
- For proof, ask for a signed read confirmation (from Encloq One) or a signature on a document (Encloq Pro). Neither is a qualified electronic signature, as the post on signature types explains.
What encryption can’t do
End-to-end encryption protects files on the way and in storage. It can’t stop an authorised recipient from saving, forwarding or photographing what they received, and Encloq still processes account and billing details and some operational metadata. Choose recipients with care.
What is the safest way to send confidential documents to a client?
A channel that encrypts the content end to end, limits access to the people you invite and lets you end that access. If it has to be email, encrypt the file with a long password and share the password by phone or text message.
Is a password-protected PDF secure enough?
For an occasional file it can be, if the password is needed to open the document, is long and travels separately. A password that only restricts printing or editing doesn’t stop anyone from opening the file.
Do my clients need an account to receive files in Encloq?
Yes, a free one. They accept your guest invitation and sign in with a passkey, or use an existing account. With Encloq Pro you can cover the storage of the conversations you start.
See a client exchange in Encloq
Invitation, files, questions and the client’s confirmation in one end-to-end encrypted conversation. The interactive examples run right in your browser.