Secure file exchange without the enterprise sales call

Two problems share one name

The enterprise version is a system, not a tool. Files move between machines on a schedule, transfers are logged for audit, failures retry themselves, and someone has to prove to a regulator that the chain held. Nobody clicks anything. If your finance team pushes a nightly file to a payments processor, that is this.

The everyday version is a person sending a document to another person. A contract, a set of accounts, a design file too big for email, a folder of photographs. It happens once, it involves a human on both ends, and the security question is narrower: did it get there, could anyone else read it on the way, and can I stop them reading it afterwards.

Most people searching this term are in the second camp and get sold the first. The gap between what those two things cost is enormous.

Email is the weak link, and everyone quietly knows it

Attaching a document to an email and pressing send is still the default, and it is the default because it is easy, not because it is safe.

Mail in transit is usually encrypted between servers now, which is better than it used to be. What that does not cover is everything either side of the transit. The attachment sits in your sent folder and their inbox indefinitely, gets forwarded without you knowing, and lands on a phone signed into a shared iCloud account. Autocomplete puts the wrong Dave in the To field and there is no way to take it back.

The ICO's guidance on encryption and data transfer is worth ten minutes if you handle anything personal, because it is refreshingly specific about where the risk actually sits.

The mistake I see most often is not a lack of encryption. It is a lack of revocation. A password on the file is the usual substitute, and it creates its own mess: signing a PDF that has been locked down is what that looks like from the recipient's side. You cannot unsend an attachment. That single property is why link-based sharing beats attaching for anything sensitive, and I have gone into the detail in is it safe to send documents over email.

The protocols underneath, in plain terms

If you do land in the enterprise half, you will meet a small pile of acronyms. They are less mysterious than they look.

Take a wholesaler sending a daily stock file to a retailer. Twenty years ago that went over plain FTP, in the clear. Now the retailer's IT team hands over an SFTP endpoint, a username and a public key, and the wholesaler's system connects over SSH and drops the file with the whole session encrypted. That is SFTP, and it covers most business-to-business file movement.

FTPS is the older alternative, FTP wrapped in TLS, and it survives mostly where legacy systems demand it. AS2 is what retail and healthcare supply chains use when they need a signed receipt proving delivery. Managed file transfer, MFT, is the layer on top of all of them: scheduling, retries, audit logs, alerting when the 2am job fails.

If nobody in your business has ever said the word "endpoint" to you, none of this applies. Skip it.

What to check before you pay for anything

The feature grids on these sites all say the same words, so the grids are not much use. Run a real scenario through the tool instead.

Say you are a small consultancy sending a client's payroll summary to their accountant. Walk it through end to end. Does the accountant have to create an account to open it, because if so a proportion of them will just email you asking for it as an attachment and you are back where you started. Once they have opened it, can you kill that access, or is the file now permanently theirs. Where did the copy sit while it waited to be opened, and for how long does it stay there after. If the accountant forwards the link to a colleague you have never heard of, do you find out.

Answer those four for a document you actually send, and the shortlist writes itself. The realistic failure is almost never someone intercepting a file in transit. It is a document forwarded onward six months later, by someone who had every right to read it at the time.

Data residency is the one extra question worth asking if you are UK or EU based, and the answer is usually on the vendor's security page rather than the homepage.

The tools people actually land on

For business file exchange with compliance requirements, the names that come up repeatedly are Tresorit, Egnyte, ShareFile and Box, all of which are pitched at organisations with an IT function and priced accordingly. Check current pricing on their own sites before you shortlist, because it moves and the published tiers rarely match what you end up paying.

For one-off large transfers, WeTransfer and its equivalents are fine for anything you would be relaxed about a stranger seeing. For anything else, they are the wrong tool, and I have gone through the free end of the market in secure free file sharing.

For ongoing external sharing with clients and partners, a link-based approach with expiry and revocation usually beats both. That is the territory covered in the best way to share files with external users and in our own file sharing software rundown.

Sending one document to one person is a different problem again

I should declare an interest, because this is the problem I ended up building for.

A lot of what gets filed under secure file exchange is not really a transfer at all. It is one document, one recipient, and a sender who wants to know it arrived and was understood. A proposal. A set of accounts going to an investor. A report a client is paying for.

For that, LiveDocument gives you a single link to a PDF or an image, with a recorded video walkthrough attached and page-level analytics showing how long the reader spent where. Access control is link expiration and revocation, which covers the forwarded-on problem and nothing beyond it.

What it is not: it is not storage, not managed file transfer, and not a data room. There is no watermarking and no NDA gate. If you need an audit trail a regulator will accept, or you are moving files between systems on a schedule, buy the enterprise tool and do not let anyone talk you out of it. If you are one person sending one important document and guessing whether it landed, that gap is the one I care about.

FAQ