Sending Sensitive Files: What's Safe and What's Not

Last year I helped a small business review their file sharing practices. They were emailing client financial statements as PDF attachments. To the right clients most of the time. One wrong recipient: never caught, just quietly sitting in the wrong inbox.

Here's what actually matters when you're sending sensitive files.

The Threat Model First

Different threats need different solutions. Most people's actual risks: sending to the wrong person by accident, email account breach, a file link being forwarded or found. Sophisticated attackers intercepting your traffic en route are a concern for journalists and high-risk individuals, not most business users. Match your solution to your actual threat.

Encrypting the File Before Sending

7-Zip can encrypt archives with AES-256. Create a .zip, add a strong password, send the archive via any channel, send the password through a different channel (e.g., file by email, password by text). This is simple, free, and doesn't require the recipient to have special software beyond 7-Zip (free, available everywhere).

The limitation: you still need to securely communicate the password. If you email both the file and the password, you've gained nothing from encrypting.

Better: Send Through Encrypted Channels

Signal handles file sharing up to 100MB with strong end-to-end encryption. If the recipient is on Signal, this is the easiest secure option for individuals. For business use, ProtonDrive and Tresorit offer end-to-end encrypted cloud storage with secure sharing links.

For Business: Control Who Has Access

The most common real-world breach isn't encryption failure — it's 'anyone with the link' settings on Google Drive or Dropbox. Use specific-person sharing, not link sharing, for sensitive files. Set file expiration on shared links when the service supports it. Audit your shared files periodically to revoke access that's no longer needed.