What 'secure' should mean
A secure file transfer does three things. It protects the file while it travels, so nobody on the network can read it. It protects the file while it is stored, so a leaked server does not mean leaked documents. And it controls who can open it and for how long. If a service cannot tell you clearly how it does all three, be wary.
1. Check for encryption in transit and at rest
In transit means HTTPS: look for the padlock in your browser. At rest means the stored file is encrypted, ideally with AES-256. End-to-end encryption goes a step further, where only the sender and recipient hold the key. That is the strongest option, but most mainstream services, Skypost included, decrypt on the server when an authorised person downloads.
2. Do not leave files lying around
Email attachments live in both inboxes indefinitely. Cloud links often stay public long after anyone needs them. Prefer services where files expire automatically. Skypost folders delete themselves after 7 days on the free plan, and you can delete a folder yourself as soon as it has been downloaded.
3. Send the password separately
If a transfer has a password, do not put it in the same message as the link. Send the link by email and the password by text, or read it out over the phone. Skypost's 3-word passwords are designed for exactly this: they are easy to say and hard to mishear.
4. Avoid common mistakes
Do not post download links in public places like forums or social media. Do not reuse the same shared folder for unrelated people. Double-check the recipient before sending, especially for ID documents and bank statements. And for highly sensitive files, encrypt the file yourself (for example with a password-protected archive using AES) before uploading anywhere.
A quick checklist
HTTPS: yes. Encrypted at rest: yes. Automatic expiry: yes. Password shared separately: yes. Hidden from search engines: yes. Skypost ticks all five. You can read the details on our security page.
