I am the head of IT for a microlending organization. We make small loans to new businesses, and as such we have to collect these clients' tax returns and other financial data as part of the application process. Currently this is done either by clients physically dropping them off at the office, or emailing them (obviously not very secure!).
We have to spend a lot of time prodding applicants to get us all of their required documents. We'd like to be able to write a software system with a dashboard the client can log into, listing each of their still needed documents and an upload button. Periodically clients would get an email listing documents still needed.
Now I could write this system pretty easily if we just store the documents on our VPS and in our database. But, management (I assume rightly?) is concerned that storing documents on our server would increase our liability.
Does anyone know of a way or a service that would allow something similar for sensitive documents? Say the submission form could take the file attachment and send it to a service, and then the service sends back metadata about the file, but does not allow looking at the files' contents directly.
We can set up one time "dropzones" with Foldergrid where a user can, given a unique link, upload files to a folder without logging in. However with this there is no way to know when certain documents have been uploaded (we want to send a notification to an employee when all of the documents are uploaded).
Perhaps we'll have to bite the bullet and become PCI-compliant or whatever certification is required to do this in a proper manner on our server, but does anyone have any ideas?