Secure file transfer checklist: 15 best practices

Secure file transfer comes down to a handful of habits: send only what is needed, to the right person, through an encrypted service, with a password and an expiry date, and remove access once the job is done. Encryption protects the files on the way; the rest of this checklist protects them from the far more common risks, such as wrong recipients, forwarded links and old shares nobody remembers.

Use it as a routine for confidential documents, a reference for your team, or a quick audit of how you share today. Each item is short; the details are linked where you need them.

Before you send

1. Classify the files. Is it public, internal, confidential or personal data? The answer decides how many of the steps below you need.
2. Send the minimum. Remove pages, columns or photos the recipient does not need. Data you do not send cannot leak.
3. Check the recipient. Verify the email address character by character, especially when autocomplete suggests it. A typo is the most common cause of data incidents.
4. Strip hidden data. Remove tracked changes, comments and document properties from office files, and GPS location from photos if it reveals a private address.
5. Choose the right channel. Large or sensitive files should go through a transfer service with encryption rather than as email attachments that stay in mailboxes indefinitely.

When you send

1. Use encryption in transit and at rest. Any reputable service uses TLS for the connection and encrypts stored files.
2. Turn on end-to-end encryption for confidential material, so files are encrypted in your browser and the service cannot read them. See end-to-end encryption explained.
3. Add a password and send it separately, by text or phone if the link went by email. NIST’s 2025 guidance favours length: at least 15 characters for a password used on its own.
4. Set a short expiry. Days, not months, for sensitive files. Our guide to share link expiry and passwords suggests durations by situation.
5. Limit downloads to the number of recipients, so a forwarded link stops working.

After you send

1. Confirm receipt. Download notifications, or a quick message, tell you the right person has the files.
2. Revoke access when done. Delete the transfer or let it expire; remove old cloud shares.
3. Do not keep copies everywhere. Clean up the sent folder, chat histories and the desktop copy you made for sending.
4. Keep a record for regulated data. Note what was sent, to whom and when, if your obligations require it.
5. Review your sharing regularly. Once a quarter, check the links and shared folders you still have open.

What to look for in a secure file transfer service

More on how these work on our secure file transfer page, and for regulated professions, see secure file transfer for law firms.

Red flags: fake “files shared with you” emails

File-sharing notifications are a favourite disguise for phishing. The US Cybersecurity and Infrastructure Security Agency (CISA) and the UK’s National Cyber Security Centre (NCSC) have documented campaigns that sent links looking like secure messages or file-hosting logins, and others that hid links in documents on popular file-sharing platforms, leading to fake sign-in pages. Be wary when:

• You were not expecting files from this sender, or the message is unusually urgent.
• The download page asks you to sign in with your email password or Microsoft or Google account to see a file.
• The link domain does not match the service named in the email.
• The “document” is an executable, a script or a password-protected archive you did not ask for.

When in doubt, contact the sender through another channel before opening anything, as the NCSC recommends. A legitimate transfer link lets you download without signing in to anything.

Checklist for the recipient

If you are on the receiving end of sensitive files, a few habits protect both you and the sender:

• Download promptly, before the link expires, and confirm receipt to the sender.
• Save the files to a secure location, not to a shared or public computer.
• Do not forward the link: ask the sender to send a new one to anyone else who needs the files.
• Delete the files when you no longer need them, especially if they contain personal data.
• Report anything unexpected, such as files you were not meant to receive, to the sender straight away.

Extra steps for teams and businesses

• Agree on one approved tool so staff do not fall back on personal accounts.
• Write a short rule: which data needs a password, which needs end-to-end encryption, which must never leave the company.
• Use a data processing agreement with your provider if you share personal data of EU residents; see GDPR-compliant file transfer.
• Turn on two-factor authentication for every account that can send files.
• Brand your download pages so recipients recognise genuine links from your team; see custom branding.

How much protection does each kind of file need?

Writing this table down for your team, with your own examples, is often the most effective security measure you can take: people stop guessing and use the same protections for the same kind of file.

Common mistakes that undo good security

• Putting the password in the same email as the link. One forwarded message gives away both.
• Sharing a whole folder when the recipient needed one file.
• Using “anyone with the link” cloud shares with no end date for personal data.
• Sending large confidential files as several email attachments, multiplying copies across mail servers and mailboxes.
• Zipping with weak legacy encryption and assuming it is safe; see should you zip files before sending?.
• Forgetting the recipient’s side: a file downloaded to a shared family computer or a public machine is no longer under your control, so tell recipients how to handle sensitive files.

For a fuller overview of the ways to send big files and their trade-offs, read how to send large files.

Receiving files securely

Security works both ways. When clients send you documents, give them a file request link with a password and an expiry instead of asking for email attachments, and download the files promptly to your own systems. Our guide on how to receive files from clients shows how.

The checklist in one line per step

• Classify · minimise · verify the recipient · strip hidden data · pick an encrypted service.
• Encrypt end to end when confidential · password through another channel · short expiry · download limit.
• Confirm receipt · revoke access · clean up copies · keep records · review shares regularly.