Protect Trade Secrets Digitally: Encrypted Business File Transfer

Protecting trade secrets during digital transfer comes down to four controls: end-to-end encryption using AES-256-GCM so the transport provider can't read contents, identity-bound access so only named recipients open the file, audit trails that prove who downloaded what and when, and retention limits that delete the payload from every intermediate system within days. Skip any one and you risk losing trade secret status under the US Defend Trade Secrets Act or EU Directive 2016/943, both of which require "reasonable measures" to preserve secrecy. Here's how to build those measures into daily workflow without grinding the business to a halt.

What Counts as a Trade Secret Legally

Trade secrets are defined narrowly. Under 18 U.S.C. § 1839(3), information qualifies only if it derives independent economic value from not being generally known and the owner has taken reasonable measures to keep it secret. Courts routinely strip trade secret status when plaintiffs can't show the measures. In Waymo v. Uber the court cited encrypted file transfer logs as evidence of reasonable measures. In RGP v. Turner the plaintiff lost because sensitive schematics had been emailed in plain text to a contractor without an NDA on file.

What usually qualifies: manufacturing processes, source code, customer lists with pricing, R&D data, formulations, supplier terms, internal margins. What usually doesn't: information in issued patents, publicly disclosed specs, general industry knowledge. The transfer controls you put around a file directly affect whether a court will treat it as a trade secret at all.

Encryption Has to Happen Before Upload

Transport encryption (TLS 1.3 between browser and server) protects files in motion but leaves them readable at rest on the provider's servers. For anything classified as a trade secret, encryption must happen client-side before upload. The plaintext file never leaves the sender's device.

HexaTransfer’s browser code generates a random AES-256-GCM key using Web Crypto. It does not derive that key from the optional password. The key is carried in the URL fragment after #; the fragment is separated before the HTTP request, as described by RFC 3986. JavaScript in the receiving page uses it locally to decrypt. The optional password is a separate server-side access check stored as a hash. Calling that password a PBKDF2 encryption key would misdescribe the implementation. AES-GCM provides authentication as part of the encryption mode; a separate HMAC is not the file format used here.

Authenticated Recipients, Not Just Links

A naked share link is a bearer token. Anyone who intercepts it, whether through a misrouted email, a compromised Slack channel, or a forwarded calendar invite, can open the file. For trade secrets, bind access to identity.

Practical options:

• Password-protected links with the password delivered through a separate channel (Signal, phone call, encrypted email)
• Email-gated access where the service sends a one-time code to a pre-authorized address
• mTLS (mutual TLS) for B2B exchanges between known partners
• SSO integration with SAML or OIDC for internal transfers

Dropbox Transfer, WeTransfer Pro, and Tresorit all support email verification on links. Smash requires recipients to enter a password or code. The key question: if the link leaks, what else is needed to open the file?

Audit Logging That Holds Up in Litigation

If a trade secret is later misappropriated, you'll need to prove who had access and when. That means immutable audit logs showing: upload timestamp, sender identity, recipient list, access attempts (successful and failed), download timestamps, IP addresses of downloaders, and link expiration events.

Logs must be tamper-evident. Append-only storage with cryptographic hashing (Merkle trees or blockchain-anchored timestamps) stands up better in court than a flat log file that IT could have edited. Services like Egnyte and Kiteworks publish their audit log schemas; for custom setups, push events to a SIEM (Splunk, Elastic, Datadog) with 7-year retention aligned to most statute of limitations windows for trade secret litigation.

NDAs and Click-Through Acknowledgments

Legal protection layers on top of technical protection. Every recipient of a trade secret file should have a signed NDA on file, and many courts look favorably on click-through acknowledgments shown at download time: "By downloading this file you confirm you are [named recipient], you accept the confidentiality terms of the NDA dated [date], and you will not redistribute this content."

Services supporting this pattern include Kiteworks, Intralinks (common in M&A data rooms), and Virtru with its Trust Data Format. The click-through creates a timestamped record tied to the recipient's authenticated session, which evidentially links the individual to the disclosure.

Short Retention Windows by Default

Trade secrets shouldn't sit on third-party servers indefinitely. Default retention should be measured in hours or days, not months. Standard profiles:

• Quote attachments to prospects: 48-72 hours
• R&D data to external contractors: 7 days with extension on request
• M&A due diligence materials: 30 days, auto-purge after signing
• Routine internal transfers: 24 hours

Short retention shrinks the breach window. If a provider is compromised six months from now, a file auto-deleted after 72 hours isn't in the breach. HexaTransfer — Send up to 50 GB per transfer using chunked uploads. Expiry: 1–30 whole days, 14 days by default. Dropbox Transfer maxes at 90 days but lets senders set 1-day expiration.

Watermarking and DRM for High-Value Documents

For board decks, M&A memos, or formulations, static file sharing isn't enough. Dynamic watermarking stamps the recipient's email, IP, and download timestamp onto every page of a .pdf at the moment of download. If the document leaks to a blog or a competitor, the watermark traces it back to the specific recipient.

Tools: DocSend (Dropbox-owned) does per-recipient tracking for sales decks. Fasoo and Seclore apply persistent DRM that keeps files encrypted even after download, with keys checked against a license server at each open. Caveat: DRM that depends on a license server breaks workflows where recipients are offline, so it fits executives and counsel better than field engineers.

Exit Hygiene When Relationships End

When a contractor engagement ends or an employee departs, trade secrets they had access to should be revoked. Link-based transfers make this easier than cloud folders: revoke the link, the file is gone. For subscription file rooms (Intralinks, Box), disable the account and invalidate all outstanding share links associated with it.

Build the exit into the contract. Standard boilerplate: "Upon termination, recipient shall delete all confidential files within 72 hours and certify destruction in writing." Pair it with technical revocation so the legal obligation has teeth.

Putting It Together

The working pattern for most companies: client-side AES-256-GCM encryption, password or email-gated recipient authentication, 7-day or shorter retention, immutable audit logs fed to a SIEM, NDA click-through at download, and dynamic watermarking for top-tier documents. None of it is exotic, but it requires setting a default and enforcing it rather than letting each employee pick their own tool.

Try it at hexatransfer.com — free, no account, 50 GB max.