If you are here, you're probably about to email something that truly matters—contracts, financials, cap tables, HR files, diligence packs. You want your counterparty to get it quickly, but you do not want those documents living forever in random inboxes and synced laptops. Your instinct is right. A big share of real incidents still come from boring mistakes like mis-addressed emails and accidental forwards, not movie-style hacks. Misconfigured "anyone-with-the-link" sharing makes leaks even easier.

According to Verizon's Data Breach Investigations Report, 61% of data breaches involve email-based document leaks. Meanwhile, secure document sharing platforms reduce breach risk by 85%.

Below is a founder-grade playbook that keeps the workflow humane while giving you real control.

1) Why you need this (beyond "being careful")

Email is permanent, searchable, and trivially forwardable. Once a sensitive attachment leaves, you can't revoke it; you also have no idea who opens or re-uses it. You need a way to use email as the notification layer while a controlled system handles the document. If you send confidential files often—to investors, customers, board members, counsel—this is not paranoia; it's basic hygiene.

The FTC Safeguards Rule requires businesses to implement comprehensive security programs for customer data, including encryption and access controls. Standard email attachments fail these requirements.

2) What "secure enough" must actually do in 2025

Think in bundles, not features:

Gatekeeping: Only named people or trusted domains can open. No "anyone with the link" for sensitive files. See our guide on access control best practices.
Confidentiality in transit & at rest: Use modern encryption for messages and files (e.g., Microsoft 365 message encryption, encrypted PDFs/archives when needed).
No raw attachments by default: Email carries the link, not the payload. Learn more in our secure file sharing guide.
Revocation & expiry: You can end access when a deal closes or a relationship changes. This is essential for document lifecycle management.
Attribution & logging: You can reasonably tell who viewed what and when. Check out page-level analytics for complete visibility.
Leak deterrence: Dynamic watermarking and anti-forwarding UI reduce casual leaks; be clear-eyed about limits (e.g., screenshots). Gmail's Confidential Mode is explicitly not bulletproof. See our PDF forwarding prevention guide for comprehensive protection strategies.
Usability: If it's painful, people route around it.

3) How to do it with Peony (step by step)

Peony provides enterprise-grade secure document sharing with AES-256 encryption, dynamic watermarks, granular access controls, and complete audit trails.

Peony's model is simple: email (or chat) is the doorbell; Peony is the vault.

Step 1 — Stage your docs where they belong

Upload sensitive files (decks, SoWs, security packs, board materials, HR/legal) into a Peony room named by process (e.g., "Series A – Core Docs," "Customer – Logo – Commercial + Security"). One room per process keeps access clean.

This mirrors the approach in our confidential documents guide for organized, controlled sharing.

Step 2 — Define who gets in

Grant access to specific emails (ideal) or approved domains (for known orgs). This identity-bound gate replaces risky open links and shared passwords. See password protection options for additional layers.

Step 3 — Set protective defaults

Use view-only for external parties, and disable downloads unless there's a clear business reason. Add expiry for time-boxed processes (diligence, RFPs, audits).

Step 4 — Turn on deterrence and accountability

Enable dynamic, per-viewer watermarking (email/org/timestamp) and Peony's screenshot deterrence. If something leaks, it's attributable; casual forwarding feels risky, not invisible.

Our watermarking guide explains how this protects against unauthorized sharing, similar to the protection outlined in screenshot protection.

Step 5 — Share one secure link

Drop the Peony link into your email: "Here's the secure link to the latest version." No attachments, no version chaos.

This approach is detailed in our secure file sharing best practices.

Step 6 — Update, monitor, revoke

Replace files behind the same link as facts change; see who accessed what (light analytics); revoke an individual, a domain, or the entire room when the process ends. That is the control you never get with raw attachments.

4) Other methods if you can't use Peony (credible backups)

A) Microsoft 365 Message Encryption (OME)

From Outlook, choose Encrypt / Do Not Forward to protect message content and limit forwarding/printing for recipients (works across many providers). Great in Microsoft-centric ecosystems; UX can vary for external parties.

Microsoft's documentation covers the full implementation.

B) Gmail — know the options and limits

Confidential Mode disables forward/print/download and can require an SMS code, but Google itself warns it doesn't stop screenshots or all copying; it's not end-to-end encrypted. Use as a light layer, not your vault.
Client-Side Encryption (CSE) is rolling out more broadly, including to some external recipients for Workspace enterprise tiers; it meaningfully raises the bar, though UX for non-Google recipients can involve a gated viewing flow.

C) Password-protected PDFs / encrypted ZIPs (AES-256)

Use reputable tools (e.g., Adobe Acrobat's "Encrypt with Password") and share the password out-of-band (phone/SMS). Understand the trade-offs: no revocation or telemetry; recipients can forward file + password.

See our password protect PDF guide and Excel file protection guide for detailed steps.

D) S/MIME / PGP / portals

Enterprisey, powerful, and sometimes clunky. If your counterparty runs a client portal or VDR, using it is still better than email attachments. Our data room comparison guide covers the tradeoffs if you're evaluating providers.

5) Practical setup tips (tiny habits, big protection)

Adopt one rule: If we'd be uncomfortable seeing this forwarded without us, it never leaves as an attachment. It goes via a secure link. This is covered in our confidential documents guide.
Standardize your email copy: "Sharing via a secure link so you always see the latest version and we keep sensitive docs properly controlled on our side."
Kill open links in your drives: Turn off "anyone with the link" for sensitive folders; use "specific people" plus expiry. Our secure file sharing guide covers proper access controls.
Use strong, humane passphrases when passwords are unavoidable: Favor length and uniqueness over quirky complexity; modern NIST guidance explicitly endorses passphrases.
Close the loop after the process: Revoke access for closed deals/rounds, archive the room, and move on calmly.
Educate in one minute: Attachments are permanent; links are controllable. That's the whole story. Point your team to our email security checklist for quick reference.

Bottom line

"Secure email" is not one checkbox. It's a calm, repeatable flow: identity-bound access, encrypted delivery, no raw attachments by default, revocation on demand, and clear attribution. Peony gives you that flow out of the box. When you can't use it, pick one of the backups above and apply the same principles. You'll move just as fast—and you'll look like the adult in the room while you do it.

Share Files Securely

How to Securely Send Documents via Email in 2025: Complete Guide to Email Encryption & Protected File Sharing