Send a link instead of an attachment, give it an expiry, put a password on it, and send that password through a different channel. Those four steps take about a minute and prevent nearly every realistic way a confidential document leaks. Encryption is necessary, but it is not the control that saves you — a link that still works in two years is far more likely to be the problem.
Why not an attachment
An emailed attachment is permanent and untraceable. It sits in the recipient's mailbox indefinitely, it gets forwarded without your knowledge, it is backed up by systems you cannot see — and if you sent it to the wrong address, there is nothing you can do.
A link can be expired, limited and taken back. For anything confidential that is the whole argument, whatever the file size.
The four steps
1. Upload and send a link. The email itself stays tiny, which also means it will not bounce off a strict mail server.
2. Set an expiry. The shortest that is practical. For a contract someone needs to read and sign, a week. The point is that the link stops being a live credential once its job is done.
3. Add a password. This is what protects you if the email is forwarded or the mailbox is compromised.
4. Send the password separately. By text message, or say it on a call. A password in the same email as the link protects against nothing — whoever can read one can read the other. This is the step people skip, and skipping it turns step three into decoration.
Three more things worth checking
Can you revoke it? Ask the service directly. People assume this exists, and it often does not. It is what turns "I sent that to the wrong person" from an incident into an inconvenience.
Can you limit downloads? A download limit suits a single sensitive document. It also gives you a signal: if the link has already been used when your recipient tries it, you have learned something you needed to know.
Will you know when it was downloaded? For a contract or a legal document, being able to say when the other side received it is occasionally worth a great deal.
Confidential is not the same as personal data
They carry different obligations, and it is worth knowing which you are holding.
Confidential is a duty you owe — under a contract, an NDA, professional rules, or plain commercial sense. Breaching it is a contractual or professional problem.
Personal data is information about identifiable people, and it is regulated whether or not anyone asked you to keep it confidential. That brings legal obligations: a lawful basis, a processing agreement with whoever stores it, retention limits, and breach notification duties.
A commercial contract is confidential. An employee file is both. A client's customer list is both, and the second is the one with statutory consequences. What the GDPR requires covers that side, and sending sensitive client data covers the sharper special-category cases.
Where encryption fits
Every serious service encrypts in transit and at rest. The question worth asking is who holds the key.
If the service holds it — the normal design — the service can technically read your file, and so can anyone who lawfully compels it. That is usually an acceptable trade, and it is what makes previews and virus scanning possible.
If only you hold it, the service cannot read the file at all. That is stronger, and it costs you features and forgiveness: lose the key and the document is gone. Here is how that works when the key travels inside the link itself:
The quickest test of which one you were sold: can the service show you a preview of the document, or restore your files if you forget your password? Either means it holds the key. The longer version.
For most confidential business documents, provider-held keys plus good access control is the right answer. Reach for end-to-end encryption when the provider itself is part of what you are worried about.
Where the documents end up
Which country's courts can compel the provider? That follows the company, not the data centre. A US provider storing data in the EU is still subject to US legal process — for documents under legal or professional privilege, that is not a theoretical concern. The explanation.
How long do they keep it after you delete it? Backups persist. Ask.
Habits that do more than any product
- Send the minimum. Redact what does not need to travel. A page you did not send cannot leak.
- Never reuse a link across recipients. You lose the ability to say who has what.
- Open your own link in a signed-out browser once. It catches over-sharing and broken access — the two most embarrassing outcomes.
- Review old shares. Most people have live links from years ago they have forgotten entirely. That audit is worth more than any product decision on this page.
If you work in a profession where this is daily routine, Yungle for law firms describes how the pieces fit together. For the general version without the confidentiality framing, see how to send large files securely, and for comparing services on these properties, the secure services page.