Send each sensitive file as an encrypted link that opens once, so nothing stays in a shared inbox.
Deliverables the client will keep can go to the shared drive or portal you already use. Files with credentials, personal data or financial detail are hand-offs: they should reach the client once and not persist in email.
From a free LinkPilot account, attach the file. It is encrypted in your browser with AES-GCM-256 before upload, and the key stays in the link, so LinkPilot cannot read it.
One hour for something they are waiting for, 24 hours or seven days otherwise. Burn after read is on, so the first download destroys the stored copy.
Email, your project tool or chat. The message holds only a URL. On Pro, add a passphrase and give it to the client by phone.
A burned link means it was opened. On Pro the audit timeline records when, which answers the client's own auditor later without a search through email.
No account needed. Free forever plan.
Encrypted in your browser before anything is sent. Burn after read is on for every anonymous secret.
One URL. The key after the # stays in the browser and never reaches our servers.
The first open burns the ciphertext. A second visit, by anyone, meets the destroyed page.
Browser-side encryption shipped on 29 September 2026. Secrets created before that date were stored as plaintext until they expired, and a file's name, size and type are still visible to us. Read the full security model.
Most client files are sent as attachments because it is the path of least resistance. The result is a copy in your sent folder, a copy in their inbox, copies in both backups, and forwarded copies nobody tracks. Portals fix some of this and create a login the client has to remember. A one-time link is lighter: no account on the client's side, nothing retained after the download, and a link you can revoke from your dashboard if it went to the wrong person.
If the client's policy requires a password-protected PDF or archive, send that file as they ask and put the password in a one-time link sent by a separate route. The creator below does that without an account. For the file itself, the encrypted one-time link described in the steps is the stronger option, since no copy of the file persists on either side's mail server. The send a password protected file page compares the two.
An agency workspace keeps each client's secrets and short links in their own workspace, with roles that decide who on your team can create, view and revoke. The agency page describes the console; the per-file facts on this page are the same there.
Pro, $29 a month, adds a passphrase on every secret, a custom expiry date and time, and the audit timeline that records each view, burn and revoke. See plans.