How to Receive Files From Clients Safely
Published 2026-05-20 · Updated 2026-06-22 · 8 min read · By the SENDIT team
Collecting documents from clients invites malware, oversized uploads and privacy obligations. Here is a workflow that handles all three.
Sending files is a problem you control. Receiving them is not. When clients send you documents, you inherit whatever they attach: unknown file types, enormous scans, files containing personal data you never asked for, and occasionally malware they did not know they had. A deliberate intake process turns that chaos into something manageable.
Why email intake is the worst option
Most businesses collect client documents by email because it requires no setup. The costs appear later. Attachments bury themselves in threads and become impossible to locate. Size limits cause clients to give up or to split files inconsistently. Sensitive documents sit permanently in a mailbox that may be accessed by several staff members. And every attachment is an executable-shaped risk arriving directly at a human who is inclined to open it because a client sent it.
Design the intake, do not improvise it
A good intake has four properties: a single known destination, an explicit list of what is required, a size and format specification given before the client starts, and a defined retention period after which the material is removed. Clients follow instructions when instructions exist; ambiguity is what produces twelve photographs of a document taken at an angle.
- Tell them exactly which documents you need, by name.
- Specify the format: PDF preferred, scanned flat, one document per file.
- State the maximum size and what to do if they exceed it.
- Give a deadline and a single upload destination, not an email address.
- Say how long you will keep the files and what happens afterwards.
Handling untrusted files
Treat every incoming file as untrusted until inspected, without treating the client as suspicious. The two are different things; ordinary people's machines get infected and they forward documents in good faith.
- Never open an executable, script or macro-enabled document received from a client. Ask for a flat PDF instead.
- Beware of double extensions such as invoice.pdf.exe, and enable file extension display on your machine so you can see them.
- Open unfamiliar documents in a browser-based viewer or a sandboxed environment rather than the desktop application where possible.
- Be sceptical of password-protected archives that arrive unexpectedly with the password in the same message; that is a standard malware pattern.
- Verify unusual requests, especially anything about changed bank details, by calling a number you already had, not one contained in the message.
Privacy obligations you inherit on receipt
The moment a client sends you a document containing someone's personal information, you are handling that person's data, whether or not you asked for it. That carries obligations under most privacy regimes: keep it only as long as needed, protect it appropriately, and delete it when the purpose ends.
The most practical protection is to ask for less. If you need to confirm an address, ask for a utility bill with the account number covered. If you need identity verification, ask whether a redacted version suffices. Reducing what arrives reduces everything downstream: storage risk, deletion obligations, and the consequences of any future incident.
A workflow that works
Send the client a short instruction message containing the destination, the list of documents and the format requirements. They upload, you receive an access code or notification, you collect the files promptly. Immediately move them into your own organised storage with your own naming, and let the intake share expire. Confirm receipt in writing so the client knows they are done, and record the date of receipt for your retention clock.
When the engagement ends, delete what you no longer need on a schedule rather than a whim. A written retention rule — client documents deleted twelve months after project closure, for example — is far easier to follow than case-by-case judgement, and far easier to explain if anyone asks.
Client experience matters
An intake process that requires the client to create an account, install software or learn a new interface will fail. They will email you the file instead, and your careful process becomes a document that nobody follows. Choose the lowest-friction option that meets your requirements: a browser upload with no signup, clear instructions, and an obvious confirmation that it worked. Security that people route around is not security.
What to do when something looks wrong
Have a decision already made for the moment a suspicious file arrives, because in the moment people open things out of politeness. The rule should be: do not open it, do not forward it, and contact the sender through a channel you already had. If it turns out to be genuine, you have cost thirty seconds. If it is not, you have avoided the single most common route by which small businesses get compromised.
If a file has already been opened and something seems off, disconnect the machine from the network before investigating further. Speed matters more than certainty at that point.
Documenting the intake
Keep a simple record of what was received, from whom and when. It does not need to be sophisticated; a line in the project notes is enough. It resolves the frequent dispute about whether a document was ever sent, it starts your retention clock in a defensible way, and if you are ever asked to explain how personal data reached you, you have an answer. Businesses that skip this step usually discover the gap during the one conversation where it matters.