Secure file transfer for law firms and legal teams

Why email isn’t enough for confidential documents

Email is how most firms share documents, and it creates three problems for confidential files. Copies multiply in every mailbox and backup the message touches. Attachments are limited to 20 to 35 MB on common services, so large bundles get split or sent through personal tools. And once sent, you can’t take a document back or limit who it is forwarded to. A transfer link with the right settings addresses each point: one copy, held for a set period, accessible only with the link and, if you choose, a password.

The controls that matter, and how they work

With end-to-end encryption on, the part of the link after “#” holds the decryption key. Anyone with the complete link can open the files, so treat it like the document itself, and pair it with a password sent another way. Our end-to-end encryption page explains the design, and password-protected transfers covers passwords.

How to send a confidential document securely

1. 1

   Step 1

   Open Transfr and add the files

   Go to transfr.me and add the documents. Large bundles (scans, disclosure sets, recordings) can go up to 100 GB per transfer on the free plan.

2. 2

   Step 2

   Turn on end-to-end encryption

   Enable it in the transfer options. Encryption happens on your computer before upload.

3. 3

   Step 3

   Add a password and a download limit

   Set a password and, for a single recipient, a download limit of 1.

4. 4

   Step 4

   Choose a short expiry

   One to three days is usually enough for a document the client must download now.

5. 5

   Step 5

   Send the link and the password separately

   Email the link from your usual firm account; give the password by phone or text message. The files are deleted when the link expires.

Receiving documents from clients

Identity documents, contracts, medical records and evidence often arrive as phone photos in an email or a messaging app. A file request gives clients a proper channel: you share one link (or its QR code), they upload from their phone or computer without an account, up to 100 GB per submission, and you get an email when files arrive. Protect the request with a password, set a deadline and cap the number of submissions. Submitted files are kept for 7 days, so move them to your document management system promptly.

Large files: evidence, recordings and disclosure bundles

• Video and audio evidence (CCTV exports, interview recordings) routinely exceeds email limits. Send it in one transfer, byte for byte, so the copy matches the original. See send large video files.
• Scanned bundles of hundreds of pages are often 100 MB to several GB. PDFs can be previewed in the browser. See send a large PDF.
• Whole matter folders keep their structure, so the receiving party sees the same index.
• Over 100 GB, Pro has no size limit per transfer.

Reviewing drafts with clients and counterparties

For a draft agreement or a set of exhibits, turn on comments when you send the PDF. The reader can pin a note to a specific page (“clause 7.2: confirm the notice period”), and with a free account you are emailed for each comment. It doesn’t replace tracked changes in your word processor or a formal redline, but it is a quick way for a client who reads on a phone to flag questions on the right page. For sensitive drafts, combine comments with a password and a short expiry, and remember that anyone with the link can read the comments on that transfer.

Data location and GDPR

By default, Transfr stores files in Western Europe, and you can choose the region per transfer. Files are deleted when the link expires, and expired transfers are purged daily. For firms with clients outside Europe, the region option keeps data close to where it is needed. Your own obligations depend on your jurisdiction and professional rules, so check them with your compliance lead. For background, read GDPR-compliant file transfer and the secure file transfer checklist.

Good habits for legal teams

• Send the password through a different channel from the link.
• Use one-download links for documents meant for one person.
• Prefer short expiry; re-send rather than keep long-lived links.
• Open files received from unknown senders with care: Transfr does not scan files for viruses.
• Record in the matter file what was sent, to whom and when; on Pro, Send & Track shows when it was downloaded.

Firms that send under their own name can use Pro branding (logo, subdomain or custom domain) so clients recognise the download page, and Teams to give up to 10 colleagues a shared space. See the general secure file transfer guide.

Before rolling it out, try the full flow with a colleague: an encrypted transfer with a password and a one-download limit, then a file request they answer from their phone. It takes five minutes and shows exactly what a client will see.