I'm working on a project for one of my customers. They want a web environment where the site searches for specific emails for specific users and makes the attachments of those emails accessible to view and download.
The attachments I'm talking about are annual statements, payslips and hour registration. So at least the first two files types will include some form of sensitive data, like bank numbers. Something I'm not to keen about.
Now basically my question is: how safe is it for me to read these files over a SSL connection from the email server using php IMAP, fetching the content form a file and displaying it without saving in on the web server.
The files would be standing on the email server anyway and i'm not storing the files anywhere else. Or is this thought to naive and are there any other options?
My initial idea was to download the files from the mail server and storing an encrypted version of the files in Amazone s3. Using there authenticator system to make sure displayed links only work once. And maybe delete the emails afterwards.
would this be a better idea? Minimising the connections over IMAP by storing a copy of the files somewhere else..