What happens to an email attachment

A sender's mail system stores a copy, routes another through filtering infrastructure, and delivers one to the recipient. Both organizations may journal messages for compliance. Desktop and mobile clients synchronize local caches, and backup systems preserve historical states.

Transport between well-configured mail servers is often encrypted, but the attachment is normally readable to the mail platforms and accessible anywhere the mailbox is accessible.

What an encrypted one-time link changes

The email contains a locator instead of the plaintext file. Client-side encryption can make the stored object unreadable to the delivery service, and one-time retrieval can remove the active link as soon as it is used. Time expiry handles abandoned transfers.

This reduces copies but adds responsibility: the recipient must complete a deliberate retrieval, the sender cannot use the service as an archive, and a lost link or passphrase may be unrecoverable by design.

A decision table

Use ordinary email when the file is low sensitivity, intended as a durable record, and permitted by your organization's policy. Consider encrypted one-time sharing when:

  • the file contains credentials, identity documents, private configuration, or confidential client material;
  • the recipient needs the file once rather than as a permanent mail record;
  • you want a short, explicit expiry instead of mailbox retention;
  • you can verify the recipient and exchange a passphrase separately when needed;
  • your legal or contractual retention requirements do not require the email attachment itself to be archived.

Do not create a new weak link

A public cloud link with no expiry can be worse than a controlled mailbox. Check whether the service encrypts before upload, whether the complete link carries decryption capability, whether file metadata is protected, and how retrieval and cleanup work.

For regulated workflows, document the approved channel and retention rule. Technology supports policy; it does not decide which records your organization must keep.

Further reading