The short answer: stop sending files and start sending access.
Instead of attaching documents to an email, put them in one permissioned space and share a link to it. That way the documents stay in a place you control — you can see who opened them, change what each person sees, and cut off access when the deal dies. An attachment, once sent, is gone forever and belongs to whoever has it.
Here’s how each option actually holds up.
Email attachments
Still the default, still the worst.
Most mail servers reject anything over 20–25 MB, which rules out a survey, a full disclosure package, or anything with photography. So you compress until quality suffers, or you split it across three emails and hope the buyer reassembles them in the right order.
Then the real problem: you have no idea what happened next. Did they open it? Did they read the environmental report or just the price? Did they forward it to their partner, their lender, or a competing broker? You will never know.
Use it for: a single one-page document to someone you already trust. Don’t use it for: anything you'd be uncomfortable seeing circulated.
WeTransfer and similar
Solves the size problem and nothing else.
Links expire — usually in seven days — which is reliably shorter than a real estate transaction. Buyers come back to a dead link two weeks later and ask you to resend, or worse, don’t ask and quietly go cold.
There’s no access control. Anyone with the link is in. And the download is a zip file, meaning your carefully organised package becomes forty loose files in someone’s Downloads folder, named Scan_0043.pdf.
Use it for: a one-time bulk transfer to someone in your own office. Don’t use it for: anything a buyer needs to reference more than once.
Dropbox and Google Drive
A real step up. Files stay live, you can update them in place, and links don’t expire.
But two things break down on live deals.
First, link sharing is effectively public. “Anyone with the link” is the setting almost everyone actually uses, because per-person permissions in Drive create friction the buyer complains about. So the link gets forwarded, and the forward gets forwarded.
Second, a folder is not a presentation. A buyer opening Downloads > 1247 Bay St > Docs sees an alphabetical file list. They don’t know what to read first, what matters, or what they can skip. You’ve handed them homework instead of a pitch. On a competitive asset, that costs you.
Use it for: internal team collaboration, working documents. Don’t use it for: the package a buyer forms their first impression from.
E-signature platforms
DocuSign, Dotloop, SkySlope and similar are excellent at what they do — executing documents. They are not built for the stage before that, when a buyer is still deciding. Sending someone a signature request when they haven’t yet read the rent roll is asking for a commitment they aren’t ready to make.
Use it for: execution. Don’t use it for: distribution and evaluation.
A deal room
This is what the rest of the industry moved to, and the reason isn’t security theatre. It’s that a deal room does three things a folder can’t.
- It’s structured. You decide the order. Offering memorandum first, then financials, then the survey, then the environmental report. The buyer sees a considered package, not a filing cabinet.
- It’s permissioned per person. A lender sees the financials and the appraisal. A prospective buyer sees the marketing package. A broker’s assistant sees neither. Same link, different views, no separate folders to maintain.
- It’s observable. You see who opened what, when, and for how long. Which is the difference between “I sent it Tuesday” and “she spent eleven minutes on the rent roll and came back twice.”
What “secure” actually means for a broker
Worth being precise, because vendors use the word loosely.
You are almost certainly not worried about someone breaking encryption. You’re worried about four practical things:
- Control — can I stop access when this deal dies or the buyer drops out?
- Traceability — if this document surfaces somewhere it shouldn’t, can I tell whose copy it was?
- Gating — can I require an NDA before someone sees the numbers?
- Visibility — do I know who actually read this?
Encryption at rest is table stakes and every credible platform has it. Those four are what actually differ, and they’re what to ask about.
A practical checklist
Before you send any listing package:
- Is it in an order that tells the story, or alphabetical?
- Can I revoke access when this deal ends?
- Will I know if the buyer opened it?
- Does anything here need an NDA first?
- If this document leaked, could I identify the source?
- Will it still work in three weeks, or does the link expire?
- Does it look like it came from me, or from a file-hosting company?
If you’re answering “no” to more than two, the tool is costing you information you could be using.
Where this leaves you
For a single document to a trusted party, email is fine. Don’t overthink it.
For a package a buyer will evaluate you on — a package that determines whether you get a second conversation — a folder link throws away every signal about how that evaluation is going. You send it into a void and wait.
Shrubs is a deal room built for this. One branded space, sections you control, watermarking you switch on so every file carries the viewer’s name, optional NDA gating before anything opens, and analytics showing exactly which section each person read and where they stopped. Free plan includes 2.5 GB (USD pricing).