Use email only for low sensitivity files, an expiring link shared with named people for most reviews, and an account based portal for customers who need ongoing access. The right channel depends on how sensitive the document is, how many people need it, and how long they need it.
The three channels compared
| Channel | Strengths | Weaknesses | Fits |
|---|---|---|---|
| Email attachment | Familiar, no setup | No expiry, no revocation, no access log, copies multiply | Public or low risk summaries |
| Expiring named link | Revocable, expires, can be logged | Needs a sharing tool and some care | Most one-off reviews |
| Portal with accounts | Central, versioned, auditable | Setup and upkeep, customer must sign in | Signed customers, frequent updates |
CISA's SBOM Sharing Primer describes how SBOMs move between parties in practice, from proprietary vendors sending them by email to open source projects publishing in central repositories. Email is common, but that range shows there is a better option for most cases.
How to choose
Ask four questions in order:
- Could this document help an attacker if it leaked? If yes, skip plain email.
- How many people need it? More than three suggests a link or portal, so you control the list.
- Will it change? If you will reissue it, a portal or a stable link to the current version beats chasing old attachments.
- Does the customer expect to come back? Ongoing relationships justify a portal.
A public security overview can go anywhere. A pentest report should never travel as a loose attachment.
Making email safer when you must use it
Sometimes the customer's process demands email. Reduce the harm:
- Encrypt the file or send a link instead of the file itself.
- Send the password or key by a separate route.
- Address only the named recipients, with no distribution lists.
- Add the as-of date and version to the body.
- Record the send in your register.
Remember that email gives you no way to take the file back. Treat every attachment as permanent.
Choosing a portal without overbuilding
Before buying or building a portal, check whether your existing file sharing tool already supports named guests, expiry and access logs. Many do. A shared folder per customer with guest access that expires can serve a small company for a long time.
A dedicated portal makes sense when you have enough customers that manual management slips, when buyers ask for self serve access to current documents, or when you need approval workflows. Until then, simple and consistently used beats sophisticated and neglected.
Consistency beats perfection
Whichever channel you choose, write it down. A one page rule, "pentest reports by named link only, SBOMs by link or portal, summaries by any channel", lets every salesperson and engineer act the same way. See who should approve sharing security evidence for the approval side.
Safeguard's SBOM exports and compliance evidence can be dropped into whichever channel you pick. A free scan shows the export.
Quick check
Is a password protected zip over email secure enough?
It is better than a bare attachment, but you still cannot revoke it or log access. For sensitive files, prefer a named expiring link.
Do small companies need a portal?
Not at first. A well managed shared folder with expiring guest access often covers it. Move to a portal when volume makes manual control slip.
Sources
Last reviewed: 19 October 2026.
