A link in an inbox should not stay live forever
Share a code out of band and the document will not open without it. Pair it with an expiry window so a forwarded or forgotten link stops working. Simple controls that close the most common practical exposure.
Email is a reasonable delivery channel and a poor security boundary. An email account can be compromised, a message can be forwarded, and an inbox can be shared more widely than the sender assumed.
Access codes add a second channel. Expiry adds a time bound. Neither is sophisticated, and together they close most of the realistic risk on an ordinary document.
Step by step
- 1
Set a code the recipient already knows
A reference number, the last four digits of an account, or something you tell them by phone. Share it through a different channel from the document itself — a code sent in the same email defeats the purpose entirely.
- 2
The document will not render without it
The recipient enters the code before any content is displayed. Failed attempts are rate-limited and logged. Neither the code nor its contents are recorded in the audit trail.
- 3
Set an expiry window
A fixed date or a rolling window from send. After expiry the link stops working and the document is voided, so nothing stays accessible indefinitely because someone never got round to it.
- 4
Escalate where identity really matters
For higher assurance, add SMS one-time passcodes, knowledge-based authentication, or government ID verification. Apply these per document rather than account-wide so routine paperwork stays frictionless.
What it supports
Where this matters most
Healthcare
A verification step against the number on record is a small amount of friction against a meaningful risk of misdirected patient information.
See healthcare →Legal
Settlement documents and board consents where an accidentally forwarded link is a genuine problem rather than an inconvenience.
See legal →Real estate
Knowledge-based authentication is a common expectation on higher-value transactions, applied per document rather than to every disclosure.
See real estate →Availability & limits
Free and upAccess codes and expiry on every plan. Stronger identity verification is Pro and Business.
- SMS one-time passcode requires Pro
- Knowledge-based authentication and ID verification require Business
- A code shared in the same email as the document provides no protection
- Expired documents are voided, not paused — you resend rather than extend