Receiving and sharing mortgage documents securely: a guide for advisers and estate agents

If you receive and send mortgage documents carefully, you protect your client's financial details and your firm's reputation. A mortgage file tells almost everything about someone's finances, and these documents often go back and forth by email in several rounds. A few fixed habits keep them from sitting in mailboxes for years.

Below you will find which documents are the most sensitive, why ordinary email is not made for them, how to have them delivered securely and how to send them yourself. At the end are the questions clients ask most often.

The most sensitive documents

• A copy of the ID document.
• Payslips, an annual income statement and an employer's statement.
• Bank statements and overviews of other loans.
• For a purchase: the purchase contract and often a valuation report.

Together they say a lot about your client's income, assets and situation. A single payslip looks harmless, but add a passport copy, an address and bank details, and you have a file that lets someone convincingly pose as your client.

Why ordinary email is not ideal

Once sent, an attachment sits in several places: in your client's sent folder, in your inbox and on the email providers' servers. There is no date when that disappears, and nobody can see whether the email was forwarded.

An example. Your client emails their documents to your general address. A colleague forwards them to the adviser, who saves them to a shared drive. After the purchase the file is closed, but the email with payslips and passport still sits in three mailboxes. With a mortgage, many documents arrive in a short time, often in several rounds, so more and more copies appear.

Have your client upload the documents

Most of the risk disappears when your client uploads instead of emailing. You send one link to a page in your firm's branding. Your client confirms with a code by email and uploads the files without an account. They are encrypted in the client's browser before they are sent, and only you can open them.

That matches what a client expects from a professional: clarity about where their documents go. A client who does not have to install anything and sees straight away where to upload also delivers faster and more completely. If something is missing later, send a new request instead of replying to the old email thread.

How to send documents carefully yourself

1. Send only what is needed. What you do not send cannot leak.
2. Use a link with a short lifetime, for example 5 days. After that the link stops working and the documents are no longer with the transfer service or sitting as attachments in mailboxes.
3. Have the recipient confirm with a code sent to their own email address. If someone forwards the link or reads along, it is useless to them.
4. Check the recipient's address carefully. A wrong address receives both the link and the code. To be sure it is the right person, choose an identity check with Certified Delivery.
5. Check that the documents arrived. You get an email once everything has been downloaded, and with Certified Delivery also a PDF report.

Where the limits are

A secure link keeps documents out of mailboxes and stops working by itself after the chosen period. But once someone downloads the documents, they sit on that person's computer. For the documents you receive from your client, that means you decide how they are kept in your file and when you delete them. A link that expires does not take back anything already downloaded.

How that works at TransferGuard

Files are encrypted in the browser before upload and stored encrypted in the EU. By default, TransferGuard emails the recipient a link without the key. The key is only released after the recipient confirms with the email code, or with Certified Delivery an SMS code or identity check. If you want the key never to reach our server, choose the option where you share the link yourself. That is end-to-end. After the chosen period we delete the files.

For free you can send up to 3 GB per transfer, 3 transfers per calendar month, and files stay available for 5 days. Certified Delivery costs € 15 a month excluding VAT. With it you request files from your client in your own branding, send up to 25 GB per transfer and get a PDF report with a timestamp from an independent party, kept for 1 year. The report shows when the files were collected and that they arrived complete and unchanged. It does not prove that anyone read them.

Questions clients ask

• Do I need to create an account or install anything? No, your client needs no account or app.
• Why can't I just email the documents? Because they would then sit in mailboxes for years. Through the link they reach you encrypted.
• What happens to my documents once the application is done? At TransferGuard they are deleted after the chosen period. What your firm downloaded is kept in your own file, under your own rules. Tell your client how long that is.
• Is this enough for the lender? That is up to the lender. TransferGuard takes care of the secure transfer.

This article is about receiving and sharing documents securely and is not mortgage advice. Which documents are needed and how long you may keep them is set by the law, your professional rules and the lender.