Best Practices for Sharing Sensitive Files in 2026

Most guidance on sharing sensitive files collapses into "use encryption". Encryption matters, but it is rarely the thing that fails. What fails is access that outlives its purpose, links that travel further than intended, and no record of what happened.

Here is a checklist that addresses the failures that actually occur.

1. Give access an expiry date by default

Almost every document you share has a natural lifetime. A quote is relevant until the deal closes. A candidate’s reference is relevant during the hire. Access should end when the reason ends, and the only reliable way to make that happen is to decide it up front — nobody comes back later to tidy up.

Pick the shortest window that gets the job done. You can always issue a new link; you cannot un-share an old one that has been sitting open for a year.

2. Cap the number of opens for one-off sends

If a document is going to one person for one purpose, a view limit of one or two turns a leaked link into a dead link. It also gives you a signal: if the limit is hit sooner than you expected, something is worth asking about.

3. Match verification to sensitivity

Not everything needs a password. A published price list does not. A settlement agreement does.

Two mechanisms cover most cases. A password, shared over a different channel than the link — text the password, email the link, so one intercepted channel is not enough. Or email verification, where the recipient proves control of a specific address before the document opens, which also ties each view to a person rather than to a URL.

4. Keep an audit trail you could actually show someone

In regulated work, "I sent it" is not evidence. What holds up is a record of when a document was opened, by whom, and from where — ideally one you did not write yourself after the fact.

This matters most at exactly the moment it is hardest to reconstruct: a dispute, an audit, or a breach review months later. Decide before you need it whether your tooling can produce that record.

5. Do not make recipients sign up

This is a security control, not a convenience. Every account you require is a reason for someone to route around your process — forwarding the file to a personal address, or asking you to "just email it". Security that people avoid is not security.

The mistakes that undo everything else

A few habits quietly defeat the controls above.

• Sending the password in the same message as the link.
• Setting an expiry so long it may as well be permanent.
• Reusing one link for many recipients, so the audit trail cannot distinguish them.
• Sharing the whole folder when one file was needed.
• Never reviewing what is still open — access accumulates silently.

None of this requires a security team. It requires deciding, at the moment of sending, how long access should last and what proof you will want later. The tool should make that the easy path.