Encrypted file request tools: who can read the uploads?

In transit: the upload travels over HTTPS. Every tool here does this. It protects the file on the wire and nothing else.

At rest, with provider-held keys: the provider encrypts the stored file. This protects against a stolen disk; the provider can still decrypt, and so can anyone who compels or compromises it.

On the uploader’s device, to a key only you hold (often called end-to-end or zero-knowledge): the browser encrypts before upload and the provider stores ciphertext it cannot open. This is the property that matters for IDs, tax returns and privileged material. The caveat for any web app is that the provider also serves the code doing the encryption.

Tresorit has run end-to-end encrypted file sharing for years and its file requests sit inside a full encrypted drive with admin controls, optional uploader email verification and, on Enterprise, a custom domain for links. If you already pay for Tresorit, its file requests are the obvious choice.

FileSeal puts your logo on the client-facing pages and sends expiry reminders on its Professional plan, and its one-time-download model suits firms that want nothing retained after collection. File Request Pro is the strongest workflow tool here: branded pages, forms, scheduled reminders to clients and automatic filing into the cloud drive you already use — at the cost of the provider and your cloud drive being able to read the files.

ShieldFive is lighter on all three: your logo only on the paid plan or trial, at most two reminders to the client and only on the paid plan, no custom domain. What it offers is client-side encryption to a post-quantum hybrid key on every request, EU hosting, no email or account demanded of the uploader, and a free tier to try it with 1 open request at a time before paying €29 per seat per month for unlimited.

Ask three questions and look for the answer in the vendor’s own documentation, not its landing page. Where is the file encrypted — in the uploader’s browser or on the server? Who holds the key that decrypts it — you alone, or the provider too? And if the provider holds a copy of the key “for convenience”, as FileSeal’s default mode does, which mode are you actually using?

Also check what the uploader is asked for. An email address, a phone number or an account is personal data you are now collecting, and a step some clients will not complete.

The firm needs a free ShieldFive account to create requests and hold the keys; only the client skips signup. Every link needs a PIN of at least four characters. Links last up to 7 days on the free plan; on Firm seats they can be set to expire after 30 or 90 days or left open. You can revoke one at any time. Each request accepts up to 1,000 files, 25 by default. Free accounts include 10 GB of vault storage, and uploads count against it.

Like every browser-based encryption tool on this page, we serve the JavaScript that encrypts. The guarantee is “encrypted in the client’s browser, ciphertext at rest”, not a claim that no compromised server could ever interfere. The security page for requests sets out the threat model in full.