Authorize the recipient, not only the file
File encryption can restrict access without proving that the recipient is correct, still authorized or using a controlled destination. Build the handoff around identity verification, minimum scope, a separate secret channel, receipt confirmation and an auditable return or disposition.
Outside counsel needs a limited review set. The coordinator confirms the named recipient through an existing matter channel, prepares a minimized package, protects it, sends the secret separately, and obtains a receipt that identifies the package and destination.
Run the control in five steps
- 01Confirm recipient identity, role and continuing matter authorization.
- 02Minimize the package to the approved request.
- 03Protect the archive and test it on a recipient-like system.
- 04Transmit the package and secret through separate channels.
- 05Record receipt, exceptions and final disposition.
Preserve a defensible decision trail
Keep recipient, authorization source, package ID, manifest version, transfer channel, secret-channel owner, send and receipt times, integrity result, exceptions and return or deletion confirmation.
Stop and investigate when
- The password travels in the same message as the archive.
- A generic mailbox is treated as proof of recipient identity.
- The recipient can retain copies indefinitely without a decision.
State what the control does not prove
Does not replace provider permissions, guaranteed backup, password recovery or enterprise identity management. Validate preservation, authorization, plaintext copies, provider controls and recovery separately.
Legal discovery security questions
Does encryption authorize the recipient?
No. Authorization is an identity and matter-governance decision.
Should the password be in the transfer log?
No. Record who sent it and by which separate channel, not the secret.
Sources for this decision
Links support specific control decisions and do not imply endorsement.