Almost every family will need to share a sensitive document at some point. A college student needs a copy of a Social Security card to start a job. Aging parents need to share insurance details with an adult child. A spouse needs to send a notary the tax return. In all of these moments, the default tools — email, text message, or "just take a photo" — create real risk. This guide covers what to do instead.
Why email is the wrong default
Email is the most common way people share sensitive documents, and it is among the worst. Three reasons stand out:
- It persists. A document attached to an email lives in your sent folder, the recipient's inbox, every backup either of you has, and any forwarded thread — possibly forever.
- It is not encrypted end to end. Most consumer email services encrypt mail in transit, but providers can read content, attachments are often scanned, and breaches happen routinely.
- It is easy to forward. A single email can be forwarded to anyone, and the original sender has no way to know it happened.
A photographed passport sent over email might be in twenty inboxes by the time it gets to where it needed to go.
What to look for in a sharing tool
The right tool for sharing sensitive documents has four qualities:
Per-document permissions
Share one document, not a whole folder. Sending someone a link to a single insurance card should not give them visibility into the rest of your financial life.
Recipient identification
A secure share is tied to a specific person, not a public link. The recipient should authenticate before they see the document — ideally with their own account, but at minimum with a one-time code or password.
Expiration and revocation
Every share should have an expiration date. If you need to share a document for a one-time event, the link should die when the event is over. And if you change your mind, you should be able to revoke access instantly.
Audit logging
You should always be able to see who accessed what and when. This is both useful (knowing the document made it to the right person) and protective (catching unexpected access early).
Common scenarios and the right approach for each
Sharing IDs for a one-time verification
A school, employer, or service is asking for a scan of your ID. Best approach:
- Scan the document and store it in a secure vault.
- Share the specific document with the requestor's email address.
- Set the share to expire after a few days.
- Revoke access once the verification is complete.
Do not email the scan as an attachment. Do not text it. Do not use a generic file-share link.
Sharing financial records with a tax preparer
Tax preparers need access to multiple documents over several weeks.
- Group the relevant year's tax documents into a single category in your vault.
- Grant the preparer access to that specific category, not your entire vault.
- Set access to expire at the end of tax season.
- Revoke when the return is filed.
Many tax preparers will have their own secure upload portal. That is also fine — but never email tax documents as plain attachments.
Sharing insurance information with an adult child caring for a parent
This is one of the more common ongoing scenarios. The adult child needs to be able to find the right policy in the moment, without bothering the parent every time.
- Identify the documents they need — usually health insurance, supplemental insurance, and emergency contacts.
- Grant the child standing access to those specific documents in the vault.
- Review the share list once a year to make sure it still reflects current needs.
This is exactly the kind of sharing that generic cloud storage gets wrong, because the only options are "share the whole folder" or "share nothing."
Sharing estate documents with an executor
An executor will need access to a defined set of documents at a specific time. Best approach:
- Identify the executor and grant them standing access in the vault to a defined set of estate planning documents.
- Configure a trusted contact / continuity flow that activates access to a broader set under specific conditions.
- Keep the executor's contact information current.
This is one of the few cases where pre-arranged access matters more than per-request sharing.
Sharing a document with a notary
A notary needs to see and verify documents — typically once.
- Share the document for a single session.
- Confirm receipt and then revoke access immediately.
If you are video-notarizing, ask the notary platform about their own secure document workflow — it is often integrated with the session itself.
What to do if you have already shared things insecurely
If you have been emailing sensitive documents for years (most people have), do not panic — but do clean up. A reasonable first pass:
- Search your sent folder for attachments — common patterns include "passport," "license," "tax," "insurance," and your own last name.
- For each, decide whether you can delete the email (you usually can, since the original is still in your vault or in your records).
- Delete from both Sent and Trash.
- Ask close contacts to do the same with messages from you.
- Going forward, share via a secure tool, not email.
You will not recover documents already in other people's archives, but reducing your active surface area is still a meaningful improvement.
A note on passwords inside shared documents
A common pattern is to password-protect a PDF and then email it. This is better than nothing, but only barely:
- The password is usually shared in the same channel (often the next email).
- PDF passwords are removable with simple tools.
- Recipients often save the unprotected version.
If you find yourself wanting to password-protect a PDF, that is usually a sign you should be using a real sharing tool instead.
The principle to remember
Sensitive documents should travel through systems designed for sensitive documents — not through systems designed for casual communication. Every share should be intentional, identified, time-limited, and revocable.
If you want a tool built around this principle, MyDataDeposit's secure sharing is designed exactly for these scenarios. The convenience of email is not worth the long tail of exposure that comes with it.