1. Classify before sending
Ask what the material is, what harm exposure could cause, how quickly it loses value, and whether law or contract requires a particular system. Credentials often need one-time delivery and rotation. Signed agreements may belong in an approved document platform. Health, financial, or children's data may require specialist controls.
Do not let a convenient encrypted link override your customer's security policy or a regulated transfer requirement.
2. Verify the recipient
Use a contact method already established with the client. Be cautious when a new address appears mid-project or someone asks to reroute access urgently. Confirm role and authority, especially for administrator credentials, payment details, identity documents, or employee data.
For material transfers, tell the recipient what type of item to expect without placing the secret itself in the notification.
3. Build a two-channel handoff
A practical high-sensitivity pattern uses independent channels:
- Create a Relay with the shortest workable expiry.
- Add a unique passphrase that is not derived from the client name or project.
- Send the link through the normal project channel.
- Send the passphrase through a verified phone, secure messenger, or separate account.
- Ask the named recipient to confirm retrieval.
4. Minimize the payload and its context
Share only what the recipient needs. Use separate Relays for unrelated systems so one exposed item does not reveal an entire environment. Avoid including both a secret and a detailed map of where and how to use it unless the context is necessary.
For files, remove hidden metadata and unnecessary worksheets or pages before encryption. A secure channel cannot correct excessive disclosure inside the file.
5. Finish and document
After confirmation, rotate temporary credentials, transfer ownership in the source system, and remove local working copies according to policy. Record that the handoff occurred, who approved it, and when it was completed—without recording the secret, passphrase, or complete decryption link.
If retrieval is unexpected or confirmation fails, revoke the underlying credential and create a new handoff. The response should protect the source system, not depend on recovering a consumed Relay.