How to collect sensitive documents from clients without email
Short answer: Send each person a one-time secure upload link instead of asking them to email attachments. The files go straight to a protected inbox your team signs in to, are scanned for malware, and are deleted once you have filed them — so copies of passports, pay stubs or medical records don't pile up in email accounts on both sides.
Why email is a poor fit for sensitive documents
- Copies multiply. An attachment lives in the sender's Sent folder, your inbox, every forward, and every device that syncs them — often for years.
- Encryption is not end to end. Mail servers usually encrypt the connection between them, but the message itself sits readable in each mailbox, and you can't control the other side's security.
- Mistakes are easy. One wrong autocomplete sends a client's ID to a stranger. Misdirected email and fax are among the most common causes of privacy breaches reported to Canadian regulators.
- No record of who saw what. Email doesn't tell you who opened or downloaded a file.
What a better process looks like
- You send a link by email or text. The link carries no personal information, only access to an upload page.
- They upload from their phone — photos of documents or PDFs, no account or app.
- Files are scanned and land in one place that only your signed-in team can open.
- You download and file them in your own system (EMR, practice management, CRM, tax software).
- The copy is deleted on a schedule, so the tool never becomes a second archive.
What to look for in a secure upload tool
| Feature | Why it matters |
|---|---|
| Upload-only links | The link can't be used to see other files or other clients. |
| Data stored in Canada | Simpler to explain to clients and regulators; ask exactly where (see what "stored in Canada" means). |
| Automatic deletion | Less data held means less to protect and less to lose. |
| Two-step sign-in for staff | A stolen password alone isn't enough. |
| Audit log | Shows who sent, opened, uploaded and downloaded. |
| Malware scanning | Uploads from the public shouldn't reach your computers unchecked. |
| Nothing sensitive in the email or text | The message itself should only say who it's from and carry the link. |
Tips that work in any industry
- Say in the request exactly which documents you need — a short checklist gets complete files the first time.
- Ask for a form at the same time (contact details, consent, signature) so you're not chasing paperwork later.
- Set links to expire within days, and send reminders before they do.
- File what you need, then let the tool delete its copy.
General information for Canadian businesses, not legal advice. Laws and professional rules change — check the current version with your regulator or lawyer.
SealDrop sends your clients or patients a secure link to upload documents and fill in forms. Everything is stored in Canada and deleted once you have filed it. See how SealDrop works →
Questions
Is it safe to email a copy of my passport or driver’s licence?
It is risky: copies stay in several mailboxes and can be forwarded or exposed if any account is compromised. A secure upload link that deletes files after use is safer.
Do clients need an account to use a secure upload link?
With SealDrop, no — they open the link from email or text and upload from any phone or computer.