Secure file transfer for business: every recipient gets a personal link and a one-time code in their email, the link expires when you decide, asks for a password when it has to and records every access. You can revoke it in one click. And when you need to prove the delivery, you download a signed certificate anyone can verify.
Every transfer records who opened it, when, from which IP address and browser. And it stops the moment you want it to.
When the official channel is no use, people improvise: it is shadow IT for files. And what they improvise, you never see.
Public links circulating through email and chats, with no way of knowing who opens them or when they are deleted, on a personal account that has no contract with you.
A server set up by someone who left years ago, with shared accounts, passwords that never change and no useful log on the day it has to be audited.
It goes to whoever autocompleted in the "To" field, gets forwarded without control and sits in the recipient's mailbox forever. Sending to the wrong person is one of the most frequently notified breaches.
An employee's private account or a memory stick in a pocket. When that person leaves, your company's documents leave with them.
Dokuflex secure file transfer works in three steps: you upload the files and add the recipients; you set the expiry date, a download limit per file and, if you want, a password; and each recipient opens their personal link, enters the one-time code sent to their email and downloads from the browser without registering, while you see every access and can revoke the link in one click. For the sender it is as easy as the service they were using. For you, it stops being invisible.
From the browser or from your phone. Up to 50 files to up to 50 recipients in one send, and each recipient gets a personal link of their own.
Expiry date, maximum downloads per file, an optional password and a watermark with the recipient's email and date on PDFs. On top of that, every recipient has to enter a 6-digit code sent to their email.
The recipient downloads without registering. You are notified on the first open and the first download, you see every access with IP address and browser, and you revoke or resend in one click. When retention ends the files are deleted automatically; what you need to keep belongs in document management.
Transfer by transfer, recipient by recipient.
Files travel and are stored encrypted on Dokuflex infrastructure in the European Union. The technical detail is on the security page.
Set an expiry date and a download limit for each file. Once the deadline passes the link stops working, and when retention ends (by default, 30 days after expiry) the files are deleted automatically.
A 6-digit code sent to the recipient's email, valid for 10 minutes, with at most 3 codes every 15 minutes and a lock after 5 failed attempts, plus an optional password. It proves control of the mailbox, not identity. Your internal users sign in with your SSO and two-factor. If what you need to hand over is a password rather than a file, the sibling piece is one-time secrets.
Up to 50 recipients and 50 files per send, each recipient with a link of their own. You know exactly who accessed, and you can revoke one recipient without affecting the rest.
Every PDF downloaded carries the recipient's email and the date, so a leaked copy points back to whoever downloaded it. PDFs that are already signed are left untouched so the signature stays valid.
You are notified the first time the link is opened and the first time a file is downloaded. The notice to the recipient goes out as certified email.
Who sent what, to whom, and every access with date, time, IP address and browser, for an audit, an inspection or an incident.
A PDF signed and timestamped, verifiable by anyone through its public QR code, with the SHA-256 fingerprint of each file to check it has not changed. Sent to the wrong person? Revoke in one click, or resend.
Your own systems can create sends with the same controls and the same timeline as a send made by hand. See integrations.
Today the module sends files: a personal link per recipient, an email code, expiry, download limits, a timeline and a delivery certificate. These features are on the roadmap and are not available yet.
If one of them is decisive for your case, tell us and we will let you know when it ships.
Tell us what you needWhat changes is not convenience, it is what you can prove afterwards.
| Criterion | Dokuflex secure transfer | Consumer service | In-house FTP | Email attachment |
|---|---|---|---|---|
| Size | Free of the email limit | Capped by plan | High | 25–35 MB |
| Link expiry | You set it, with a download limit per file | Fixed on the free plan | Not applicable | Never: it stays in the mailbox |
| Recipient verification | One-time email code, plus optional password | Paid plans only | An account, often shared | None |
| Revoking what you sent | Yes, in one click, and resend | Limited | By deleting from the server | No |
| Log of who downloads | Timeline with IP address and browser | Partial | Technical logs, barely usable | No |
| Antivirus on upload | Coming soon | No | Only if you bolt it on | Whatever the mail server does |
| Where the file ends up | In the EU, deleted automatically after retention | In the provider's cloud | In a loose folder | In mailboxes you do not control |
| Proof of delivery | Signed, timestamped certificate with QR verification | No | No | No |
A transfer tool leaves you with a link and nothing else. Here the send leaves evidence and sits next to the rest of your processes.
The REST API lets your own applications, or a Dokuflex BPM workflow that calls it, create sends with the same controls as a send made by hand.
The email that tells the recipient a file is waiting goes out as certified email, and you are notified on the first open and the first download.
The delivery certificate is signed and timestamped, verifiable by QR and by the SHA-256 fingerprint of each file. It is ordinary evidence, not a qualified electronic registered delivery service (eIDAS, Articles 43 and 44); if you need agreement, use the eIDAS electronic signature.
When the retention period ends (by default, 30 days after the link expires) the files are deleted automatically. No forgotten copies sitting in someone else's cloud.
An auditor does not ask whether you have a tool. They ask how information leaves the company, who has downloaded it and with what measures in place. A channel with recipient verification, a timeline of every access and a signed delivery certificate answers all three questions with data.
Every reference is linked to its official source. This page is not legal advice: compliance also depends on your policies and on how you use the tool.
Requires technical and organisational measures appropriate to the risk, and expressly names encryption and the ability to ensure ongoing confidentiality and integrity. Sending documentation containing personal data through a consumer service is hard to defend against that yardstick. And if things go wrong, the 72-hour breach workflow is the next step.
Its risk-management measures include policies on cryptography and encryption, security in acquisition and the use of secure communications. For entities in scope, the channel files leave through is part of the perimeter. See also NIS2 and DORA incident notification.
In Spain, for anyone working with the public sector, the measures protecting communications and information require encryption, access control and traceability. The timeline and the delivery certificate document each send; the secure transfer module does not hold an ENS certification of its own. For document management under the ENS, see the ENS document management system.
For financial entities, it requires protecting data in transit and at rest and governing ICT third-party providers. A corporate channel with a contract, a DPA and a timeline of every access is the exact opposite of every team picking its own service.
Dokuflex secure file transfer covers what is expected of secure file sharing for business: a personal link per recipient, a one-time code sent to the recipient's email, an optional password, an expiry date and a download limit per file, PDF watermarking, a timeline with IP address and browser, a signed delivery certificate, automatic deletion after retention and hosting in the European Union. It replaces consumer services, ad hoc FTP folders and email attachments in companies that need to prove how their information leaves the building.
Against a consumer service it brings control and traceability: immediate revocation, recipient verification, a signed delivery certificate, automatic deletion after retention and a data processing agreement. Against an in-house FTP it removes the server you have to patch, the shared accounts and the logs nobody knows how to read; for integrations there is a REST API. We set it out in detail in the guide to dropping WeTransfer at work.
Every send can produce a delivery certificate in PDF, signed and timestamped, which anyone can verify through its public QR code and by checking the SHA-256 fingerprint of each file. It is ordinary electronic evidence, not a qualified electronic registered delivery service under eIDAS (Articles 43 and 44). When the notice itself has to be proven, the recipient is notified by certified email.
To send large files securely you do not need to split them or fall back on a consumer service. The transfer does not go through email, so the 25 MB cap in Gmail or the 35 MB default in Exchange Online stops being an issue: you upload the files (drawings, video, backups, invoice batches), up to 50 per send, and each recipient downloads them from the browser through their personal link, without registering. The maximum size per transfer is set by your plan; to send from your own systems you use the REST API, with the same controls and the same timeline.
It matters most in the sectors that have to prove how information leaves the company. In banking and finance, DORA requires protecting data in transit and at rest and governing ICT providers. In insurance, expert reports and settlement documentation go out with a personal link per recipient and a delivery certificate. In the public sector and among its suppliers in Spain, the National Security Framework requires encryption, access control and traceability, and the timeline documents every access. And in law firms and legal services, client documentation travels with a password, a watermark and a log of who opened it.
It is a corporate channel for sending files with access control and traceability. The difference from a consumer service such as WeTransfer is control: every recipient gets a personal link and has to enter a one-time code sent to their email; you decide the expiry date, the download limit per file and whether it also asks for a password; you can revoke or resend at any time, and every access is recorded with IP address and browser. When you need to prove it, you download a signed delivery certificate.
No. They open their personal link in the browser and enter the 6-digit code that arrives in their email (valid for 10 minutes). If you set a password, they enter it too. There is no registration and nothing to install.
The transfer does not go through email, so it is not affected by attachment limits (25 MB in Gmail, 35 MB by default in Exchange Online). Each send can carry up to 50 files to up to 50 recipients. For the size and storage limits of your account, ask the sales team.
Yes. You are notified the first time the link is opened and the first time a file is downloaded, and the timeline records every access with date, time, IP address and browser. You can also download a delivery certificate in PDF, signed and timestamped, which a third party can verify with its QR code and by checking the file's SHA-256 fingerprint. It is ordinary evidence, not a qualified electronic registered delivery service under eIDAS; if you need the recipient's agreement, use the electronic signature.
Yes. The link expires on the date you set and each file stops being downloadable once it reaches its download limit. You can revoke a send in one click, even if the notice is already in the recipient's inbox. PDFs carry a watermark with the recipient's email and the date, so a leaked copy points back to whoever downloaded it, and when the retention period ends the files are deleted automatically.
Not yet. Today the module sends files; receiving files from third parties is on the roadmap and is not available. We will announce it on this page when it is.
It helps with the part it covers. Article 32 of the GDPR requires appropriate technical measures such as encryption and the ability to ensure confidentiality; the NIS2 Directive asks for policies on cryptography and the use of secure communications among its risk-management measures; DORA asks financial entities to protect data in transit and at rest. A channel with recipient verification, a timeline of every access and a delivery certificate is evidence of those measures. Overall compliance also depends on your policies and on how you use it.
On Dokuflex infrastructure in the European Union, encrypted in transit and at rest. Files are deleted automatically when the retention period ends: by default, 30 days after the link expires. The detail is on the security page.
Upload the files from the browser or your phone, add the recipients, set the expiry date, a download limit per file and, if you want, a password, and send. Each recipient gets a personal link, enters the code sent to their email and downloads without registering; you see every access and can revoke or resend. Because it does not go through email, attachment limits do not apply, and your own systems can create sends through the REST API.
It is included in the Dokuflex platform. Storage and the maximum size per transfer depend on the plan; ask the sales team about plans and volumes. You can start with a free 14-day trial environment, no credit card required and no commitment. Plans are listed on the Dokuflex pricing page.
For the files your people send to customers and suppliers, yes: shared accounts and passwords that never change disappear, every recipient has their own link and code, and every access is in the timeline. It is not a managed file transfer (MFT) server for automated system-to-system batches; for integrations there is a REST API.
It is secure file sharing for business: people sending files to people, with a personal link per recipient, a one-time email code, optional password, expiry, a download limit, PDF watermarking, a timeline of every access and a signed delivery certificate. Integrations go through the REST API, and because it runs inside the Dokuflex platform, it sits alongside certified email, electronic signature and BPM workflows.
Create your account and send your first link with expiry, an email code and a delivery certificate today. Or book 20 minutes and we set up the first send for your real case with you.