I need to come up with a simple way for people within the company to send out arbitrary sensitive information to arbitrary recipients. There is an equal chance that the sender and recipient will be using a MAC or a Windows machine. Assume the sender and the recipient frequently need to share sensitive information, are not technically savvy and are impatient, meaning that anything which is considered to be too difficult to understand or takes more than a couple of steps are not going to be used (and will not be enforceable).

I have found this tool which appears to solve most of my concerns: onetimesecret.com.

It basically allows some text to be entered and then generates a self destructing link which can be shared with other recipients by email. The main concern is that it's hosted by an external organisation and that it only allows transfer of text. I will get around these issues by building our own version which includes a file upload facility and will host on our own servers.

Obviously this is not a silver bullet by any means but it appears to minimise some of the risks of sending out sensitive information via email. My only concern remaining is that it potentially makes sensitive information available over a public facing link which would otherwise only be available if an email account was breached. On the other hand, that link should in theory only be accessible if somebody already had access to the email containing the link. Due to the complexity of the links it doesn't appear to be feasible to brute force them.

So if I use a solution like this and send out the links via email, am I somehow making the file more likely to be able to be accessed than if it were included in the email alone? I cant think of any way, other than by accessing the email containing the link or by brute force, that the information could be breached.