Safely sending confidential client files requires more than encryption. Classify the material, verify sender and recipient identities, minimize the package, use private-by-default and time-bounded access, validate integrity, monitor delivery, confirm receipt through a separate channel when risk warrants it, and delete temporary copies under a documented policy.
No workflow guarantees confidentiality or delivery. Use this checklist as educational security guidance, not legal advice, a compliance certification, or a substitute for client-specific contractual and regulatory review.
1. Model the actual risks
Start with the consequence of disclosure, alteration, delay, misdelivery, or loss. A public review proxy, unreleased campaign, client tax file, source code package, building model, and regulated record do not belong in one undifferentiated “confidential” tier.
Identify likely failure paths:
- the sender selects the wrong person or wrong version;
- an attacker compromises sender, recipient, or administrator credentials;
- a recipient forwards a link or shares a device;
- an authorized recipient downloads and redistributes a local copy;
- endpoint malware reads files before upload or after download;
- permissions remain active beyond the engagement;
- an integrity failure goes unnoticed;
- logs or notifications disclose sensitive filenames; or
- the service retains payloads or backups longer than expected.
Choose controls for the risks and sensitivity you actually have. For highly restricted or regulated data, involve legal, privacy, records, and security owners before selecting a service.
2. Authenticate the sender
Do not rely on a password alone for confidential-sharing accounts. The NCSC recommends modern MFA, SSO through standards such as OpenID Connect or SAML where appropriate, and disabling legacy protocols that bypass modern controls. CISA describes FIDO/WebAuthn and PKI-based methods as phishing-resistant; app codes and number-matched push are weaker, while unmatched push can be abused through prompt bombing and SMS or voice can be phished or redirected. That ranking is general guidance, not evidence that TeraAirlift implements a particular MFA method.
3. Minimize and prepare the package
Send only the files the recipient needs. Remove hidden exports, caches, credentials, personal notes, unrelated project folders, and obsolete versions. Use a clear package name and manifest that do not disclose unnecessary secrets in notifications or logs.
Confirm the authoritative source, expected byte count, required folder structure, and recipient’s ability to use the format. If separate file-level encryption is required by policy, exchange keys through an approved independent channel; do not place the key beside the encrypted package.
4. Identify recipients and control access
Prefer named, authenticated recipients over public or reusable links. Verify addresses against the contract or a known contact channel, especially after any last-minute change. Apply least privilege, an appropriate expiry, and revocation. Review organization administrators and subprocessors that may also have access.
The U.K. NCSC recommends authenticated cloud access, MFA, carefully managed external sharing, and private-by-default resources. It notes that one managed cloud copy can support revocation and auditing in ways an email attachment cannot. This guidance is risk-based and configuration-dependent; once an authorized recipient makes a local copy, service revocation cannot retrieve it.
CISA’s SCuBA baselines include phishing-resistant MFA requirements for covered U.S. federal civilian agencies under BOD 25-01. Other organizations may use the baselines as due-diligence questions according to risk. The directive is not universal, and guidance does not prove that a vendor has implemented a control.
5. Protect the transfer path
Require TLS in transit and understand encryption at rest, key responsibility, credential lifetime, and revocation. Do not treat at-rest encryption as end-to-end encryption. Microsoft recommends HTTPS-only Azure Storage access, user-delegation SAS where possible, and a revocation plan. Its recommendation of an hour or less for certain service SAS designs addresses a specific revocation limitation; it is not a universal client-review window.
Use integrity verification to detect changed or corrupted payloads. SHA-256 can compare sender, service, and recipient copies when implemented across the lifecycle. It does not hide content, authenticate the human sender by itself, or prevent an authorized person from sharing the file.
6. Monitor and confirm delivery
Assign an operator to watch queue state, failures, recipient status, and expiry. A progress bar reaching 100% is not necessarily proof that the intended recipient obtained a usable, complete package. Confirm the expected recipient, size, manifest, and integrity result.
For higher-risk exchanges, verify receipt using a known phone number or established collaboration channel rather than replying to an unexpected email. Record who approved the transfer and any exception. Avoid copying sensitive filenames or access details into open tickets and chat rooms.
TeraAirlift’s current repository-supported workflow provides a Windows desktop operations console with file and folder queues, progress and ETA, cancellation and retry-friendly operations, history, diagnostics, authenticated recipient delivery, short-lived storage access, and SHA-256 checks before upload, at completion, and after download. Recipients can sign in and see available downloads without emailed download URLs as the primary handoff.
That linkless design removes a forwardable emailed URL and reduces one phishing surface. It does not eliminate credential phishing, impersonation, endpoint compromise, administrator abuse, recipient copying, or misaddressed identities. It does not guarantee confidentiality, successful delivery, speed, uptime, or a particular security outcome. TeraAirlift does not currently claim phishing-resistant MFA, publisher verification, SOC 2, HIPAA, ISO, or another compliance certification.
Microsoft says an Entra verified-publisher badge confirms publisher identity, not app quality, certification, compliance, or best-practice adherence. TeraAirlift does not claim completed publisher verification.
7. Close the lifecycle
After verified receipt, revoke access and remove temporary payloads according to the approved schedule. Preserve only records required for security, contractual evidence, legal obligations, or support. Confirm how object versions, recycle bins, backups, account deletion, legal holds, and recipients’ local copies are handled.
FTC guidance for U.S. businesses recommends knowing what personal information is held, keeping only what is needed, protecting it, and disposing of it securely when no longer needed. It is general guidance, not one universal retention law. GDPR Articles 5 and 28 may be relevant to purpose, minimization, storage limitation, processor selection, and contracts in an EU/EEA context, but applicability and roles are fact-specific. Consult qualified counsel for the client, data, contract, and jurisdictions involved.
8. Write the operating policy
Record who may send confidential files, the approved tool, how recipients are verified, the allowed access window, who reviews delivery and access logs, and who closes the transfer. Include joiner, mover, and leaver handling for external users and a process for exceptions under deadline pressure. A short repeatable policy is more reliable than rebuilding the controls during every urgent handoff.
Before a real delivery, run a low-sensitivity test with the actual sender, recipient, endpoint policies, network path, expiry, revocation, logging, and recovery procedure. Review TeraAirlift’s current security boundaries and Windows client, and use the relevant post-production, LiDAR, or construction workflow to assign operational ownership.
Size the access window with the transfer-time calculator, then review the guides to retention, upload mechanics, and ownership terms.
Sources
- NCSC — Using a cloud platform securely
- NCSC — Using SaaS securely
- CISA — Secure Cloud Business Applications project
- CISA — BOD 25-01 required configurations
- CISA — Multi-Factor Authentication
- CISA — Implementing Phishing-Resistant MFA
- Microsoft — Azure Blob Storage security recommendations
- Microsoft — Publisher verification overview
- FTC — Protecting Personal Information: A Guide for Business
- EUR-Lex — General Data Protection Regulation
