How to collect files from clients securely, without email attachments
Tax season, onboarding, a new matter: sooner or later you need documents from a client. Passports, payslips, bank statements, signed contracts. Most of them arrive as email attachments, because that is what the client knows how to do.
Every attachment leaves copies nobody cleans up: in the client’s sent folder, on two mail servers, in your inbox, and in every backup of each. A year after the engagement ends, the passport scan still sits in four places.
What a file request is
A file request is a link you send someone so they can upload files to you. They open it, drop the files in, and they are done: no account, no app, nothing to install. Dropbox, Box and Google Drive offer something similar. The difference that matters is who can read the files afterwards.
With those services the provider holds the keys, so the provider can read what your client sends. With an end-to-end encrypted request, each file is encrypted in the client’s browser before it leaves, and only your browser can decrypt it. The service in the middle stores bytes it cannot read.
How it works on ttl.space
- In the Orbit dashboard, under File requests, choose how long the request stays open (1, 7 or 30 days) and press New request.
- Your browser makes a key pair for that request. The public half goes to the server; the secret half stays in your browser.
- Send the link to your client any way you like: email, chat, your own website. On its own, the link only lets people send files to you.
- The client opens the link and drops in the files. Each file is encrypted in their browser with a random password, and that password is sealed to your request’s public key. They never see or type a password.
- If you turned on email notices, you get an email when something arrives. The files show up in your dashboard marked Received, and your browser opens them with the key it kept.
Nobody else can download them, not even the client who sent them: received files open only with your Orbit key, in a browser that holds the request’s key.
Under the hood it is the same cryptography as any other ttl.space upload, plus one step: the per-file password is sealed with libsodium’s crypto_box_seal. How the encryption works has the details.
What the server keeps
For each file that arrives: the ciphertext, the sealed password (which it cannot open), the size and times, and the usual audit record of the upload. For the request itself: its link, its public key, its times and a hash of your Orbit key, until a day after it ends. File names, contents and passwords never reach it in readable form.
Before you send the link
The key lives in your browser. That is what keeps the server out, and it also means that clearing this browser’s site data, or moving to another computer, leaves you unable to open what arrives. Before you send a request out, press Copy key backup link and keep that link somewhere safe. Opening it in another browser, with your Orbit key active there, gives that browser the request’s key too. Treat it like a password: it opens everything the request receives.
Files are kept until the request ends. Download what you need before then. Closing a request early stops new uploads at once; files already received stay until the request’s end date.
Limits. A request takes up to 100 files, each up to 10 GB, and they count against your Orbit storage. You can have up to 50 requests open at once.
It is an Orbit feature. Sending files is free and needs no account. Collecting them through a request needs an Orbit plan, because the files are stored under your key.
Who it is for
Accountants collecting year-end paperwork. Lawyers taking in documents from a client (the other direction is covered here). HR asking a new hire for an ID and a signed contract. Landlords checking a tenant’s papers. Anyone who asks people for documents that should not sit in an inbox for years.
Where it stops
Once you download and decrypt a file, it is an ordinary file on your computer. Protect that computer the way you would protect the paper originals.
A request link lets anyone who has it send you files, so share it only with the people you expect files from, and close the request when you have what you need.
If you need e-signatures, forms, reminders or a client portal, this is not that. It does one job: get documents from someone else’s device to yours, with nobody in between able to read them.