How to share files with clients securely

Delivering the report is the moment your work leaves your control. It’s also where many PIs take their biggest security risk: a surveillance report and forty minutes of video attached to an email, or a folder link that anyone with the URL can open, left live for years.

This guide compares the common ways to deliver reports and evidence, explains what each protects against, and ends with a simple routine you can adopt this week.

What “secure” needs to mean for a delivery

For investigative work product, a secure delivery should do five things:

1. Only the intended recipient can open it. Not anyone who gets hold of a link, not the email provider, and ideally not the service in the middle.
2. It doesn’t change the files. Evidence must arrive exactly as sent, so its hash still matches.
3. Access can end. Links expire or can be revoked; you’re not relying on files sitting in someone’s inbox forever.
4. You have a record. What was sent, to whom, when, and ideally when it was opened.
5. The client can actually use it. Attorneys and adjusters won’t install unfamiliar software or manage encryption keys. If it’s too hard, they’ll ask you to “just email it.”

No option is perfect on all five. Here’s how the common ones compare.

The options

Plain email attachments

Avoid for sensitive material. Email is usually encrypted between mail servers, but it’s stored readable in both mailboxes, synced to every device, backed up, and easy to forward or misaddress. Size limits also push you to compress video, which changes the files. Email is fine for “your report is ready,” not for the report itself.

Encrypted email

Some providers encrypt messages end-to-end between their own users, and many offer password-protected messages for outside recipients. That’s better than plain email, especially if you send the password through a different channel (a phone call or text, never the same email). Size limits still apply, and recipients may find the extra steps annoying.

Password-protected PDFs and ZIP files

Useful as an extra layer, with caveats. The protection is only as strong as the password and the encryption option chosen (use AES-256 where offered). Send the password separately. It doesn’t solve the “sits in an inbox forever” problem, and it doesn’t work well for large video.

Consumer cloud links (Google Drive, Dropbox, OneDrive)

Convenient and handles large files. By default the provider holds the encryption keys, so the provider’s systems can read the files. Google offers client-side encryption for Workspace, but only on certain higher-tier editions and it needs admin setup. If you use these services:

• Share with specific named accounts, not “anyone with the link.”
• Set an expiry date where the service allows it.
• Turn off download where appropriate, or at least turn off re-sharing.
• Revoke access when the case closes.
• Check whether previews recompress media; send originals as files, not as streamed previews.

Messaging apps

Signal and WhatsApp messages are end-to-end encrypted, and Signal in particular is well regarded. But messaging apps often recompress photos and video (so your hashes won’t match), they aren’t tied to your case records, and on WhatsApp chat backups are only end-to-end encrypted if the user turns that on. Fine for quick coordination with a client, not for delivering evidence.

Physical media

A USB drive or disc delivered by hand or courier is still sometimes requested, especially for large video productions. Encrypt the drive, send the password separately, include a hash list, and log the delivery in your chain-of-custody record.

Client portals

A portal gives the client a login where they can read updates, download reports and evidence, and message you, all tied to the case. The big advantages are that nothing sits in an inbox, access is controlled per client and can be removed, and there’s one place to look. The questions to ask are the same as for any vendor: does the portal provider hold the keys, or is the content encrypted so that only you and the client can read it? See zero-knowledge encryption, explained.

For messaging rather than file delivery, see choosing secure messaging for client communication.

Why attorneys care

Attorneys have their own professional duties around confidentiality, and many will ask how you protect sensitive material in transit and at rest. Investigative work product in litigation is often exactly the kind of material they’ll ask about.

Attorneys also generally don’t want their investigator’s report arriving somewhere it could be forwarded carelessly, because work-product protection can be lost through disclosure. If you’re retained by counsel, ask how they want reports delivered and marked, and follow their instructions. Offering a secure delivery method up front is a sign of professionalism, and our guide to working with attorney clients covers this further.

Large video files

Surveillance video causes most of the “just email it” temptations. Some practical points:

• Don’t compress to fit. Compression creates a new file with a different hash. Deliver originals; add a compressed “viewing copy” if helpful, clearly labeled as a derivative.
• Include the hash list. A text file listing each file name and its SHA-256 hash lets the recipient confirm nothing changed in transit. See how to hash and verify an evidence file.
• Tell the recipient what to expect. File count, total size, format, and whether they need a particular player.

For naming, offloading and backing up footage before it’s sent, see surveillance video and photo file management.

A simple delivery routine

1. Agree the method at intake. Put it in the engagement letter: how reports and evidence will be delivered and to whom. (See the client intake checklist.)
2. Confirm the recipient. Verify the email address or account before the first delivery. Re-verify if a client asks you to send elsewhere, and do it by phone on a number you already have.
3. Deliver through the agreed secure channel, with a hash list for evidence files.
4. Notify separately. A short email saying the report is available, without the content.
5. Record the delivery in your case file and chain-of-custody log.
6. Close access when the case is over or at the agreed time.

Red flags

• A client asks you, by email, to send files to a new address “because the old one isn’t working.” Call them.
• A request to send the full file to someone not named in the engagement.
• Pressure to deliver unencrypted “just this once” because of a deadline. A courier-delivered encrypted drive or a quick portal invitation usually takes less time than cleaning up a misdirected email.

Spotted an error? Tell us by email and we'll correct it.