How to send confidential documents safely
Sending a confidential document by email attachment copies it into your sent folder, both mail providers, the recipient’s inbox, and every backup behind them. You cannot count those copies, expire them, or take them back.
Here is a method that keeps the document under your control from the moment you send it.
Decide how long access should last
Nearly every confidential document has a natural lifetime. A quote matters until the deal closes; a reference matters during the hire. Set the expiry to the shortest window that does the job — issuing a fresh link later takes seconds, while un-sharing an old one is impossible.
Match verification to how damaging a leak would be
Not everything needs a password. A published brochure does not; a settlement agreement does. Two controls cover most situations, and they can be combined.
- Password — simple and effective, provided you send it over a different channel than the link.
- Email verification — the recipient enters a code sent to their address, so each view is attributable.
- Allow-list — restrict a share to specific addresses, so a forwarded link is refused.
Send the link, not the file
A link is revocable; an attachment is not. That single difference is what lets you recover from the most common mistake in document handling, which is not a sophisticated attack but autocomplete choosing the wrong contact.
Keep the receipt
When a document matters, so does proof it arrived. Capsule records each open with a timestamp, and on verified shares, the address that opened it. That is the difference between "I sent it on the 3rd" and being able to show it was opened on the 4th.
Common questions
- What is the safest way to send a confidential document?
- Send a link with an expiry rather than an attachment, add a password or email verification when a leak would be damaging, and keep a record of who opened it. The essential property is that access can be withdrawn after sending, which email attachments cannot offer.
- Is it safe to email confidential documents if I password-protect the file?
- It is better than nothing, but the copies still exist permanently in both mail systems and cannot be revoked or counted. Password-protecting a file also does not tell you whether it was opened or forwarded.
- How do I stop a document being forwarded?
- Restrict the share to specific email addresses so the recipient must verify one of them before the document opens. A forwarded link then fails for anyone else, and you can see which address opened it.