10 Everyday Situations That Call for a Secure File Transfer

Most sensitive files don't feel sensitive when you send them. They feel routine. It's Tuesday, the accountant needs last quarter's statements, and the attach button is right there.

That's why it helps to recognize the situations in advance. Below are ten that come up in almost every company, grouped loosely by team. For each one: what usually happens, why it's a problem, and what a secure file transfer looks like instead.

"Secure file transfer" here means three specific things: the file is encrypted before it leaves your device, the link works once, and the file is deleted from the service after delivery or at a deadline. That's how Konfidant works, and it's what you should expect from any service you use for this.

For engineering and IT

1. Handing a new developer the .env file

What usually happens: someone drops the staging .env in a Slack thread on day one so the new hire can get the app running. That file contains database URLs, third-party API keys and probably a token or two with more access than anyone remembers.

Instead: send it as a one-time file share that expires by end of day. The new hire downloads it once; the copy in transit is gone. Better still, use it only until their secrets manager access is approved, then rotate anything that was shared.

There's a longer guide to this one: how to share API keys without leaving them in Slack.

2. Distributing credentials during an incident

What usually happens: it's 2 am, something is down, and an on-call engineer needs the break-glass database password. It gets pasted into the incident channel, where 30 people can see it and it stays long after the postmortem.

Instead: send it as a one-time secret directly to the person who needs it, and add "rotate break-glass credential" to the incident checklist. If you script your incident tooling, Konfidant's API can generate the link automatically.

3. Giving a contractor the one file they need

What usually happens: the contractor gets added to a shared drive folder "just for now". Six months later, they still have access, and so does the agency they work for.

Instead: send exactly the files they need as one-time links with a sensible expiry. Nothing to revoke later because nothing stays open. For ongoing work, give them a properly scoped account and an end date.

For legal and management

4. Sending a contract or NDA for signature

What usually happens: the PDF goes out as an email attachment. It now lives in your sent folder, their inbox, both sets of backups, and every forward in the thread.

Instead: send the document as a one-time link with an expiry that matches your signing deadline. The counterparty downloads it and does what they need to. The copy on the sharing service doesn't outlive the deal. For more on this, see why email is the wrong place for confidential documents.

5. Sharing board materials before a meeting

What usually happens: the board deck goes out via a cloud link a week early. The link works for anyone who has it, indefinitely.

Instead: send each director their own one-time link. If a link shows as already used when a director tries it, you know something's off, which is information a shared cloud link never gives you. Keep the master copy in your own board portal or records system, because you'll need it later.

6. Exchanging documents during due diligence

What usually happens: a mix of email attachments, ad-hoc drive links and the occasional USB stick. Nobody can say afterwards where the documents ended up.

Instead: for large, structured diligence, a proper virtual data room is the right tool. Konfidant fits the gaps around it: the one-off sensitive file that a party asks for by email, the signed side letter, the credentials to a data room itself.

For HR, finance and operations

7. Sending offer letters and payslips

What usually happens: offer letters with salary, equity and personal details go out as attachments, sometimes to personal email addresses. Payslips get emailed monthly, and each one sits in an inbox for years.

Instead: send each document as a one-time link to the individual. A leaked inbox then contains a list of dead links rather than a year of salary history. See the HR use case for how this looks in practice.

8. Sending a customer data export to a vendor

What usually happens: a CSV of customer records goes to an agency or a support vendor for a one-off job, attached to an email or uploaded to a drive folder that nobody cleans up.

Instead: send the export as a one-time file share with a short expiry, and make sure you have a data processing agreement with the vendor. The vendor downloads it into their own system; your copy in transit is gone. Under GDPR, fewer stray copies of personal data is always the easier position to defend. More on that in GDPR and secure file sharing for business.

9. Sending statements to an accountant or auditor

What usually happens: an annual bundle of statements, payroll exports and tax documents is emailed to an external accountant. Their inbox keeps it long after the audit is done.

Instead: send the bundle as a single secure file transfer with an expiry of a few days. The accountant downloads it into their own system, which is where it should live. The finance use case covers the common variations.

10. Sending bank details for a payment

What usually happens: IBANs and account numbers get emailed between companies, and payment-diversion fraud depends on exactly this habit. Attackers who get into a mailbox can watch invoice threads and send "updated bank details" at the right moment.

Instead: send bank details as a one-time secret, and confirm any change of details by phone using a number you already have. Konfidant can help with the first part; the phone call is the part that actually stops the fraud.

What these have in common

Look back at the list and you'll notice the same pattern every time. Someone needs a file once. The default tool keeps it forever. The risk isn't the moment of sending, it's the months and years after, when the file sits in places nobody is watching.

A secure file transfer service fixes that by making "gone after delivery" the default. It doesn't replace your document management system, your HR records or your board portal. It replaces the email attachment and the forever-link in between.

When not to bother

To keep this honest, here's where you don't need any of this:

• Files that aren't sensitive. Nobody needs a one-time link for the office party invite.
• Files people collaborate on. A link that works once is no good for a document five people edit.
• Very large files. Konfidant supports up to 5 MB on the free plan, 100 MB on Premium and 200 MB on Enterprise. For multi-gigabyte transfers, use a dedicated large-file service.

Questions people ask

Do recipients need an account?

No. They open the link in a browser and click to download. Only senders need a Konfidant account.

How long can a link stay open?

Up to 8 hours on the free plan, 7 days on Premium and 30 days on Enterprise. You can set it shorter.

Can I tell whether a file was downloaded?

The recipient will see an error if someone else already opened it. On Enterprise, verified burn records the time each share was opened, without recording who opened it.

Is this suitable for enterprise file transfer?

For one-off sensitive files, yes. Paid plans add custom domains, audit logs, team management and an API for automating transfers; Enterprise adds your own branding on download pages and verified burn. For bulk, scheduled system-to-system transfers (the kind traditionally done over SFTP), you'd want a managed file transfer product instead.

---

Want to try one of these? Send your first file free. It takes about a minute. If you're still deciding what makes a file share secure in the first place, start with the case for files that expire.