How to send a proposal securely (password, expiry, revoke)

To send a proposal securely, share it as a tracked link with access controls rather than as an email attachment: put a password on it, set a date it stops working, and keep the ability to pause or delete it later. An attachment cannot be secured after it is sent — it is a copy on someone else's device, it can be forwarded to anyone, and there is no version of "please delete that" that you can enforce.

Last updated: August 2026

What "securely" actually needs to mean

For a business document — a quote, a contract, a deck with real numbers in it — security is not encryption theatre. It is four practical properties:

1. Only the intended person can open it.
2. You know who did open it.
3. It stops being readable when it should.
4. Stopping it actually works, including for someone who already had it open.

An emailed PDF fails all four. A link with the right controls can satisfy all four, but — and this is the part worth being careful about — plenty of tools satisfy only the first three.

The one test that separates real revocation from decoration

Here is the failure mode, and it is common enough to be worth ten seconds of your time before you trust anything with a client's numbers.

Many document viewers display pages by loading images from a public file address. The link you share is tracked; the images behind it are not. Anyone who opens the browser's developer tools once can copy those addresses, and they will keep working after you pause the document, after it expires, and after you delete it — untracked, forever.

The test: share a document with yourself, open it, then pause it in your dashboard and reload the page you already had open. If the pages still appear, the pause switch is decoration and so is the expiry date.

On a correctly built tracker — including tracked document sharing here — every page is fetched back through the link itself and re-checked against the document's current state, so pausing genuinely closes it, mid-read, for someone who already has it on screen.

The controls worth using, and when

A password. Use it when the document contains numbers you would not want a competitor quoting back to you, or when it is going to a shared inbox several people can read. Share the password over a different channel from the link — a message rather than the same email — or you have simply put the key under the mat.

An expiry date. Use it on anything with a shelf life: a quote whose pricing is only valid for thirty days, a deck tied to a specific round, a contract draft. It also does a quiet commercial job — a document that will stop working on the 30th is a deadline nobody has to enforce personally.

A name-and-email gate. Use it when you need to know who read it, not just that someone did. This is the only way to distinguish three people at the same client, and it is also the honest way: the reader is told and consents. Expect a small drop-off, and skip it when the document is going to one person you already know.

A pause switch. The everyday control. Deal closed, deal lost, wrong version sent — one click and the document is closed without deleting the analytics you have already collected.

Downloads off by default. If readers cannot download the original file, there is nothing to forward on. Turn downloads on deliberately, when you want them to keep a copy.

	Emailed PDF	Tracked link with controls
Restrict who can open	No	Password, or a name + email gate
Automatic expiry	No	Yes, on a date you choose
Revoke after sending	No	Pause or delete, effective immediately
Forwarding	Uncontrolled	Downloads off by default
Record of who read it	None	Per reader, when you ask for it

A sensible default for each kind of document

• A standard proposal to a known contact: tracked link, no gate. You want the read data, and every extra step costs you readers.
• A proposal with pricing going to a committee: name-and-email gate on, so you can see who in the organisation actually engaged.
• A contract or anything with personal data: password on, expiry set, downloads off.
• A general capability deck you are happy to have shared: tracked link, no controls at all. Let it travel; the analytics still tell you where it went.

What this does not protect against

Worth saying plainly, because tools that imply otherwise are lying: nothing stops a determined reader from photographing their screen, and no control makes a document unreadable to someone who is allowed to read it. What these controls do is prevent casual leakage — the forwarded attachment, the link that keeps working two years later, the file sitting in a shared drive nobody remembers adding — which is how business documents actually escape.

Frequently asked questions

Should I password-protect the PDF itself instead? It is an option, but a poor one for client work: the reader needs a compatible reader app, the password travels with the file forever, and you still cannot revoke or track anything. A link-level password is easier for them and far more useful to you.

Can I change the password later? Yes — set a new one, or remove it entirely, without changing the link you already shared.

Does an expiry date delete the document? No. It stops the link working. Your analytics remain, and you can extend or remove the expiry whenever you like.

What happens to someone reading it when I pause it? They stop being able to load further pages immediately. That is the whole point of pages being served through the link rather than from a public address.

Send the next one with the controls on

Take the proposal you were about to attach, share it as a tracked link with a password and an expiry date, and run the pause test yourself. It takes a minute and it tells you exactly how much your current process is protecting you.

Read next: how to send a document behind an NDA, document tracking without a subscription and when to follow up on a proposal. When you are ready, send a tracked document with the controls that fit it.