An alternative to Dropbox and OneDrive file requests for sensitive documents

Keep using Dropbox File Requests or OneDrive Request files for anything that would not hurt if the storage provider, or someone who breaks into it, read it. They are included in plans you may already pay for and your staff know them.

For Social Security numbers, passports, pay stubs and statements, use a request link that encrypts each file in the client’s browser before upload. Tresorit File Requests do that on paid Tresorit plans. ShieldFive document requests do it with a per-request checklist, a PIN and no email address from the client. For free links in general, see the free secure upload link comparison, and for Dropbox alone, the ShieldFive vs Dropbox File Request comparison.

Available on every Dropbox plan. The client needs no Dropbox account; you give the request a title and description, can add an optional password, and get an email whenever a file is uploaded. Deadlines need Professional or a business plan. Files can be up to 2 GB each on Basic, Plus and Family and up to 250 GB on Professional and business plans, and they take up space in your Dropbox (Dropbox: create a file request).

Dropbox encrypts files in transit and at rest, and says it “doesn’t offer client-side encryption” (Dropbox: how security works). Dropbox holds the keys and can read what your clients upload.

Anyone with the link can upload without OneDrive; a client who is not signed in types a first and last name that Microsoft does not validate, and you get an email for each upload. It works only with OneDrive for work or school, not OneDrive for home (Microsoft: create a file request), and your admin must allow “Anyone” links; the admin can also set an expiry for request links (Microsoft Learn: enable file requests). Microsoft 365 Business Basic, which includes OneDrive, is $7.00 per user per month paid yearly (Microsoft 365 business plans).

Microsoft says that “by default, Microsoft manages all cryptographic keys” for SharePoint Online and OneDrive for Business; a customer-managed option, Customer Key, exists (Microsoft Learn: service encryption). Either way this is encryption on Microsoft’s side, not in the client’s browser.

Tresorit’s file requests are end-to-end encrypted and need no Tresorit account, but every uploader must give an email address. You get one request per folder, an optional expiry and email verification, and a 5 GB limit per upload session. The feature is on Personal Pro, Professional, Business, Business Pro and Enterprise plans (Tresorit: file requests overview), and you get an email each time someone uploads (Tresorit: create file requests).

Tresorit Professional is €23.99 a month for one user and Business €16 per user per month with at least three users (Tresorit business pricing). It is a mature, full cloud drive; if you want your whole file store end-to-end encrypted, not only intake, it is the stronger choice.

If the files are not sensitive, or your firm has decided that Microsoft- or Dropbox-held keys are acceptable under its own security policy, the file request you already pay for is the simplest answer. Your staff know it, files land where you already work, and nothing new needs approving.

Look elsewhere when a client is sending something whose leak you would have to report, when your written security plan says only the firm should be able to read client identity or tax documents, or when your admin will not turn on “Anyone” links in Microsoft 365.

ShieldFive is not a cloud drive. Files arrive in your ShieldFive account, not in the Dropbox or OneDrive folder where you work, so someone has to move them. There is no integration with either service.

Chasing is light. On Firm seats (and during the trial), if you add the client’s email, ShieldFive reminds them at most twice, after about three and seven days, while required items are missing. The reminder cannot contain the upload link, because the decryption key never reaches our server, so it points the client back to the link you sent. You also get a reminder to follow up. Your firm name and logo appear on the upload page on the paid plan and during the 14-day trial. There are no recurring requests.

You need a free ShieldFive account to create requests; only the client skips signup. Every link needs a PIN of at least four characters, which is one more thing to pass on.

Like any web app, we serve the JavaScript that does the encryption. The guarantee is “encrypted in the client’s browser, ciphertext at rest”, not a claim that no compromised server could ever interfere. The request security page sets out the threat model, and the encrypted file request tools comparison covers more options.