Beyond passwords: securely sharing sensitive data

The principles behind secure password sharing — one-time access, automatic expiry, encryption in transit, no persistent copies — are not unique to passwords. They apply equally well to any sensitive data that needs to move from one person to another: financial figures, contract terms, medical information, personal identification data, and more.

If you have adopted a secure workflow for credential sharing, the same thinking can extend to other sensitive data handoffs that your organization handles.

What makes data "sensitive" enough to warrant secure sharing

Not everything requires one-time delivery. But some categories of data are clearly in scope:

Personally identifiable information (PII): Names combined with ID numbers, addresses, financial account details, medical record numbers. Under GDPR, PII must be protected with appropriate technical measures.

Financial information: Account balances, salary figures, budget data, pricing that is commercially sensitive.

Legal information: Contract terms before signing, settlement figures, legal strategy.

Healthcare data: Diagnoses, prescriptions, test results. Subject to particularly strict protection requirements in most jurisdictions.

Business confidential: Intellectual property, product roadmaps, M&A information.

Personal credentials: Not just passwords, but also PINs, security question answers, and access codes.

Current insecure practices for sensitive data

The same habits that create problems for password sharing exist across sensitive data:

• Email attachments: A PDF containing a medical record, financial statement, or contract draft is emailed as an attachment. It sits in both parties' email archives indefinitely. If either party's email is compromised, the document is exposed.

• Shared links with persistent access: Google Drive or Dropbox links that are "view only" — but remain accessible for months or years. The document never expires.

• Consumer messaging apps: WhatsApp, iMessage, and similar apps are not designed for sensitive data. Message history is retained on devices (and sometimes in cloud backups) indefinitely.

• Fax (yes, still): Healthcare and legal sectors in many countries still use fax for sensitive documents. Fax is not encrypted and paper records create physical security concerns.

Applying one-time link principles beyond passwords

The core properties you want for sensitive data sharing are:

1. Encrypted in transit: Data should not travel in plaintext
2. Limited access duration: The data should be accessible only for as long as needed
3. No persistent uncontrolled copies: After access, the data should not exist in the sharing channel's archive
4. Access confirmation: Ideally, you should know when the data was accessed

For text-based sensitive data (short notes, account numbers, PINs, contract clauses), a tool like PassTransfer can deliver this. The recipient retrieves the information once, and it is deleted.

For larger documents (PDFs, spreadsheets), purpose-built secure document sharing tools exist that apply similar principles: time-limited links, access logging, and automatic expiry.

Practical applications

HR and payroll: Salary information for individuals should never be in an email. A one-time link with a 24-hour expiry delivers the information and leaves no email archive trail.

Client onboarding: When gathering sensitive client information (ID documents, financial records), requesting it via a secure upload channel rather than email reduces your liability.

Contract negotiations: Sharing draft contract terms with counterparties via time-limited links prevents outdated versions from being referenced after a deal is closed.

Healthcare referrals: Patient information shared between healthcare providers should travel via encrypted, time-limited channels — not email attachments.

Legal discovery: Documents shared during legal proceedings often contain highly sensitive information. Time-limited, logged access links provide a better chain of custody than email.

The underlying principle

The insight behind secure password sharing is simple: information that only needs to be accessed once should only be accessible once. Information that only needs to be available for a day should expire in a day.

This principle does not apply only to passwords. It applies to any sensitive data where the risk of prolonged, uncontrolled access outweighs the convenience of persistent availability.

Once you have built the habit of using one-time links for passwords, extending the same thinking to other sensitive information is a natural and valuable next step.