# How to share sensitive information securely with a client or contractor

> Scope the credential, send it as a one-time encrypted link, and rotate at handover. How to share sensitive information securely with a client or contractor.

Source: https://evergist.com/blog/share-sensitive-information-securely/
Published: 2026-09-30

**Short answer:** to share sensitive information securely with a client or contractor, scope the credential to their job, send it as an end-to-end encrypted link that works once and expires, and rotate it when the work ends. The same kind of link fits any short text that one person needs once, such as an API key, a recovery code, or bank details. Credentials a team keeps using belong in a password manager or a secrets manager, files go through encrypted file transfer, and a phone call confirms who you're sending to.

## How do you send credentials to a client or contractor?

Scope the credential, send it once, and rotate it when the work ends. Clients and contractors sit outside your password manager, so a no-account link fits.

**Scope.** Create a credential for this person and this job. A separate API key with the narrowest permissions, a database user limited to the tables they need, an account of their own in place of the shared admin login. Write down what you issued.

**Send.** Put the credential in a one-view note with a short expiry and a generated password:

```sh
printf '%s' "$CLIENT_API_KEY" | npx -y evergist create --views 1 --expires 1d --generate-password --json
```

The JSON output has `url`, `expiresAt`, `maxViews`, `deleteToken`, and `password`. Email the `url`. Give the `password` over the phone or in a text. Keep `deleteToken` to yourself, since it deletes the note without the link. If the contractor sees "This note doesn't exist anymore" on their first visit, it expired, was deleted, or someone else opened it. If it shouldn't have expired yet, assume someone else read it. Revoke that credential and issue a new one.

**Rotate at handover.** On the last day, revoke or rotate everything on the list from the first step. A careful send limits who saw the secret. Rotation ends the access. If the client sent you credentials during the project, tell them which ones to rotate.

## What counts as sensitive information?

Anything that lets someone act as you, or that you can't take back once it's out. The two groups need different handling.

- **Things you can change.** Passwords, API keys, tokens, recovery codes, database credentials, `.env` files. If one leaks, you rotate it and the leaked copy is dead.
- **Things you can't change.** Bank account numbers, national ID numbers, dates of birth, a private note about a person. A leaked copy stays valid, so the goal is fewer copies in fewer places.

Email and chat fail both groups, because they keep every message and index it for search. Our [password sharing guide](https://evergist.com/blog/how-to-share-a-password-securely/) covers what to avoid, so this post sticks to picking the right method.

## Which method fits which data?

| What you're sending | Situation | Use |
|---|---|---|
| Password, API key, token | One person needs it once, and you share no password manager | One-time encrypted link |
| Password, API key, token | A teammate needs ongoing access | Password manager sharing |
| Keys an app, server, or CI job reads | A machine needs them on every run | Secrets manager |
| Recovery or backup codes | One person, once | One-time encrypted link. They store the codes in their own password manager |
| Bank details, ID number | Text, one recipient | One-time encrypted link with a password sent separately, after a call to confirm the recipient |
| `.env` or config file | Text under 512 KiB | One-time encrypted link |
| Scans, PDFs, contracts, photos | A file | Encrypted file transfer |
| Records where you must show who saw what | Any | A system with access logs. Not a note service |
| Private handoff note | One reader, short life | Encrypted link with an expiry |

## When is a one-time encrypted link the right choice?

Use one when the data is text and one person needs it once. The tool should encrypt on your device, put the key after the `#`, and delete the note on the first read.

On Evergist, paste the text into the [form](https://evergist.com/#new-note), keep "1 view (burn after reading)", pick a short expiry, and send the link. [How to send a private note](https://evergist.com/blog/how-to-send-a-private-note/) walks through each option and what the recipient sees. From a terminal it's one command:

```sh
npx -y evergist create .env --views 1 --expires 1h
```

[Share a .env file with a teammate](https://evergist.com/blog/share-env-file-with-a-teammate/) covers that case. The recipient needs no account and no install, which suits people outside your company.

## When should you use a password manager instead?

Use it when the recipient needs the credential more than once. A one-time link delivers a value. A shared vault keeps it and lets you change it in one spot.

Password managers can also reach people outside the vault. 1Password creates a link to a copy of an item for anyone, with an expiry and a choice between anyone with the link and specific email addresses ([1Password support](https://support.1password.com/share-items/)). Bitwarden Send transmits text up to 1,000 characters or files up to 500 MB through temporary links ([Bitwarden help](https://bitwarden.com/help/about-send/)). If you already pay for one of these, start there.

## When do you need a secrets manager?

You need one when the reader is software. An app, a server, or a CI job that reads a key on every run should fetch it from a secrets manager.

A one-time link is read once and then deleted, so it can't do that job. It fits the step before, when a person hands the first credential to another person or to an agent. [One-time links vs a vault for AI agents](https://evergist.com/blog/one-time-links-vs-vault-for-ai-agents/) goes through where that line sits.

## How do you send files and documents?

Use a tool built for files, with encryption on your device and an expiry. A passport scan or a signed contract is a file, and a text note can't carry it.

Bitwarden Send handles files, per the help page above. Among the tools we checked in [Private note sharing compared](https://evergist.com/blog/private-note-sharing-compared/), Enclosed, PrivateBin, and Yopass support attachments. Evergist does not.

## When is a phone call the right answer?

A call does two jobs that no link can.

- **It confirms the recipient.** Before you send bank details or an ID number, or before you act on a message asking you to, call a number you already have for that person. A link protects the data in transit. It does nothing if the address you were given belongs to someone else.
- **It carries the second half.** If you protect a note with a password, read the password out on a call. The link travels by email, the password by voice, and someone who reads the mailbox has half of what they need.

A call is a bad way to deliver a long API key. Use it for identity and for short passwords.

## What is Evergist wrong for?

We built a text-only note service with a 512 KiB cap and a 30-day maximum. It is the wrong tool for several things on this page.

- **Files and documents.** No attachments, no images, no PDFs.
- **Anything that must last.** A note is deleted at its expiry or on its last view, and nobody can recover it. Evergist is not a vault or a secrets manager.
- **Anything that needs an audit trail.** We store no IP addresses, no read timestamps, and no record of who opened a note, as [what we don't collect](https://evergist.com/security/#what-we-dont-collect) documents. You can check how many views are left. You can't prove who used them.
- **Regulated records.** We make no compliance claim of any kind. If a law or a contract sets rules for how you handle a record, use a system that was built and certified for that.
- **Hiding a value from its reader.** Whoever opens the note sees the text, and that includes an AI agent that reads it.

## Questions

### What is the best method to send credentials to a client?

Issue a credential scoped to their work, send it as an end-to-end encrypted link that works once, and deliver a password for that link through a second channel. Rotate the credential when the project ends.

### Is it safe to send the link and the password in the same channel?

No. If both arrive in the same email thread, whoever reads that thread has both. Send the link one way and the password another, or say it out loud.

### What should I rotate when a contractor's work ends?

Every credential they held, including API keys, database users, shared logins, deploy keys, and tokens in any `.env` file you sent. Remove their accounts and vault access in the same pass.

### Can I use Evergist for bank details or ID numbers?

Yes, if they're text and one person needs them once. Add a password, send it separately, and confirm the recipient on a call first. For scans of the documents themselves, use encrypted file transfer.

## Next steps

- Agent instructions, with every command: https://evergist.com/SKILL.md
- MCP server, CLI, and REST API setup: https://evergist.com/agents.md