How to send sensitive documents securely: tax forms, IDs, contracts and client files
Regular email is not a secure way to send Social Security numbers, tax forms or ID scans, as the FTC puts it. Use a link with access controls or encryption instead, collect documents through a portal rather than inboxes, and delete what you no longer need.
By the editors of ProtectYour.com Last reviewed 4 min read
Affiliate disclosure: this guide links to Dropbox DocSend, Proton for Business, Fax.Plus and signNow. If you sign up through those links we may earn a commission, at no extra cost to you, and that does not change what we recommend. Free options come first, and we say where a competitor is the better fit. How we make money
Key takeaways
- The FTC tells businesses that unencrypted email is not a secure way to send information fraudsters could use.
- Start with what you already pay for: encrypted email in Microsoft 365 Business Premium, and expiring, restricted share links in Google Drive or OneDrive.
- Send a link, not an attachment: you can limit who opens it, set an expiry and revoke it later.
- A dedicated tool such as DocSend helps when you share financials or contracts with outsiders and want view tracking.
- Use fax only when a recipient requires it, and e-signature to stop signed scans piling up in inboxes.
Why attachments are the problem
An emailed attachment is a copy you cannot take back. It sits in your Sent folder, in the recipient's inbox, in any backups and on every phone that synced it. If either mailbox is ever compromised, every W-2, passport scan and voided check in it goes with it. That is why criminals who break into a business inbox search it for words like "W-2", "SSN" and "wire" first (see business email compromise).
The FTC's guide for businesses is blunt: "Regular email is not a secure method for sending sensitive data," and businesses should encrypt any transmission containing information fraudsters could use (FTC, Protecting Personal Information). The same guide says to keep sensitive data only as long as you have a business need for it.
Start with what you already pay for
- Microsoft 365. Microsoft lists Purview Message Encryption as part of Microsoft 365 Business Premium (Microsoft). It adds an Encrypt option in Outlook. Check your own plan; Microsoft's documents disagree on what lower plans include. For files, a OneDrive or SharePoint link set to "specific people" is better than an attachment.
- Google Workspace. Share from Drive to named people rather than "anyone with the link", and use the Add expiration option on a person's access. Google offers it on work and school accounts (Google). Gmail's confidential mode adds an expiry and blocks forwarding, but it is not end-to-end encryption and does not stop screenshots.
- Your accounting or tax software. Many have a client portal for collecting documents. Using it keeps tax forms out of email entirely.
Free step
When a dedicated tool earns its place
Which tool fits which job
| Job | Good fit | Why |
|---|---|---|
| Sharing financials, pitch decks or due-diligence files with outsiders | Dropbox DocSend | Links you can revoke, expiry, passcodes, and a record of who opened what |
| Encrypted email and file storage for the whole team | Proton for Business | End-to-end encrypted mail and Proton Drive links with passwords and expiry |
| A recipient that insists on fax (some medical offices, courts, agencies) | Fax.Plus | Online fax from a browser or phone, no fax machine or shared office line |
| Contracts and forms that need signatures | signNow | Signing in one place with an audit trail, instead of signed scans in inboxes |
None of these is required if the built-in options above cover you. A five-person firm that shares a few files a month with its accountant does not need a separate product. The case for one gets stronger when you regularly send sensitive files to people outside the company and want to see, or stop, what happens to them afterward.
Fax and e-signature, honestly
Fax survives because some recipients still require it. If you only fax a few times a year, an online fax service is simpler than a machine, and it keeps the document off a shared office tray. Where the recipient offers a secure upload portal, use that instead: it is usually the better route.
E-signature helps security in a less obvious way. Every contract signed by printing, signing, scanning and emailing leaves another copy of a signature and personal details in someone's inbox. Signing in one place reduces those copies and gives you a record of who signed and when.
Habits that matter more than tools
- Collect, do not receive. Ask clients to upload to a portal or a restricted folder rather than emailing you their documents.
- Verify before sending. A request for W-2s or payroll data by email, even from the owner, gets confirmed by phone on a known number.
- Clean up. Delete attachments and expired shares once a job is done, and shred paper copies. The FTC says to keep sensitive information only as long as it is needed.
- Protect the accounts. Secure sharing means little if the mailbox has no multi-factor sign-in. Our small business checklist starts there.
Common questions
Is it safe to email a W-2 or Social Security number?
No. The FTC tells businesses that regular, unencrypted email is not a secure way to send sensitive data. Use encrypted email, a restricted and expiring share link, or a client portal instead.
What is the most secure way to send documents to a client?
Send a link to a file shared only with that person, with an expiry date, from a business account protected by multi-factor sign-in. Encrypted email or a client upload portal are also good options.
Is Gmail confidential mode encrypted?
Not end to end. Gmail's confidential mode can set an expiry and block forwarding, but Google can still read the content and recipients can take screenshots.
Is fax more secure than email?
Not inherently. Fax is still required by some medical offices, courts and agencies, and an online fax service avoids a shared machine. Where a recipient offers a secure upload portal, that is usually better.
Your next step
If you want a paid toolAffiliate link
Dropbox DocSend
Best for: Small businesses that send sensitive files to outsiders (financials, contracts, pitch decks) and want to revoke access or see who opened them.
Not for: Occasional personal file sharing, where an expiring link from the storage service you already use is enough.
Visit Dropbox DocSendRelated guides
- Business email compromise and invoice fraud: how it works and how to stop itThe scam that costs small businesses the most involves no malware, only a convincing email and a rushed payment. Here is how it works and how to stop it.
- Small business cybersecurity checklist: the 10 controls that matter mostTen controls, in the order we would do them, for a business without an IT department. Most are free and take an afternoon.
- Keep your personal phone number and home address off your business listingsWhen you run a business from home, your personal cell and address end up on your website, invoices, state filings and Google listing, and from there on people-search sites. Give the public a business phone number, a separate mailing address and a registered agent address instead, and know the rules each one has to follow.
- Choosing a password manager for a small business, and the offboarding rule that matters mostAny of the three business password managers most small firms consider (1Password, Bitwarden, Proton Pass) is a large step up from a shared spreadsheet or a browser's saved passwords. Pick on the admin features you need, then set up shared vaults and an offboarding routine on day one.