How to send sensitive documents securely, and how to ask a client to.

Updated November 2, 2026

What “securely” should mean

Every tool calls itself secure. For a document you’d be in trouble for leaking (an engagement letter, a bank statement, an ID, photos for a claim, a draft settlement), check it against four plain questions:

Who can read it on the way and in storage?Encryption “in transit” and “at rest” protects against someone tapping the network or stealing a disk. It does not stop the provider itself, or someone who breaches the provider, from reading the file, because the provider holds the key. End-to-end encryption means only the sender and recipient hold it.
Where do copies end up?An email attachment lives in the sender’s Sent folder and the recipient’s inbox, and in both providers’ backups, until somebody deletes all of them. Fewer copies means less to lose.
Can you prove it arrived?“Did you get my documents?” is a phone call you can avoid. A good channel shows the sender it was delivered and opened.
Will the other person actually use it?The most secure method fails if a client can’t work it on their phone and falls back to texting you photos. No account, no app, large files, and it works from a link.

The common options, compared

General defaults as of November 2026. Specific plans and settings vary; check the provider's own documentation.
	Who can read it	Copies left	Delivery proof	Easy for a client
Plain email attachment	Mail providers on both ends	Both mailboxes, indefinitely	No	Yes, until ~25 MB
Email with a password-protected PDF	Anyone with the password	Both mailboxes	No	Awkward; PDFs only
Provider "confidential" / encrypted email modes	Varies; often the provider	Depends on the mode	Sometimes	Recipient may need to sign in
Cloud-drive share link	The drive provider + anyone with the link	Until unshared	Rarely	Mixed; may need an account
E-signature envelope	The signing vendor	In the vendor's cloud	For the signature, yes	Yes, for signing only
End-to-end encrypted client portal	Sender and recipient only	One place, deletable	Delivered + opened	Yes, from a link

A practical routine for a small firm

Decide what counts as sensitive.IDs, financial records, anything about a dispute, anything the client would be hurt by if it leaked. Default those to the secure channel, and stop sorting case by case.
Give each client one place to send things.A per-matter portal beats a mix of email, text and drive links. Everything lands in the same place and nothing goes missing.
Send the access a different way from the link.If a link is emailed, send its code by text or say it on the phone. Then one compromised mailbox isn’t enough to open it.
Confirm receipt without a phone call.Use a channel where the client can see that you received and opened their upload.
Keep a record, then clean up.Save what you keep to your file of record, and close or delete the exchange when the matter ends.

Where Brun fits

Brun’s client portal is built for exactly this routine: one end-to-end encrypted page per client, opened from a text with no account, files up to 2 GB each in either direction, receipts that show who at the firm opened what, and e-signature on the same page. Brun stores only ciphertext. Details on secure file sharing for law firms.

Weighing email specifically? See a client portal compared with email.

Questions people ask

Is it safe to email sensitive documents?

It is common, but it is not private in the way most people assume. Standard email is usually encrypted between servers, yet the message and attachment are readable on each provider's systems and stay in both mailboxes until someone deletes them. For anything you would not want read by a third party, use a channel that encrypts the file before it leaves the sender's device.

Is a password-protected PDF secure enough?

It is better than nothing if the password is strong and sent a different way, but PDF passwords are only as strong as the password chosen, the file still sits in both inboxes, and you get no record it was opened. It also does nothing for photos, videos or other file types.

What does end-to-end encrypted mean for file sharing?

The file is encrypted on the sender's device and can only be decrypted by the intended recipient. The service that stores and moves it never has the key, so neither its staff nor anyone who breaches it can read the file.

How do I ask a client to send documents securely?

Give them one place to send everything instead of asking for email attachments: a portal link that opens on their phone without an account, accepts photos and large files, and shows them when your firm received and opened what they sent.