Building Secure File Delivery is Harder Than It Looks
One-Time Links Are Not Trivial
Generating a signed URL is easy. Building the full stack around it, encryption, burn-after-download, auto-delete, expiry, audit log, GDPR retention policy, takes weeks and keeps breaking.
Emailing Files From Automations Leaks
Sending a PDF as an email attachment from a cron job or an AI agent means the file sits in inboxes, mail servers, and backups forever. Your clients expect better.
Agents Need a Safe Hand-Off
An AI agent can generate a contract, a statement, or a report in seconds. What it cannot do safely is email that document as a plain attachment. It needs a secure, audited delivery channel.
One Call. Encrypted. Delivered. Gone.
Your app or agent calls the API. FileSeal handles everything else.
1. Call the API or MCP tool
REST or stdioPass your file and the recipient's email (or just request a link). Use the REST endpoint directly or add the fileseal-send MCP server to your AI assistant.
2. Recipient gets a one-time link
AES-256 encryptedIn the default link mode your app relays the one-time link to the recipient and the encryption key lives only in the link fragment, so FileSeal cannot read the file. In the opt-in email mode FileSeal emails the recipient a working link and holds the key to do so.
3. Downloaded once, then deleted
Audit trail includedThe link works exactly once. After download the seal is burned and the file is deleted from FileSeal's servers. The event is recorded on your dashboard audit trail.
Where Teams Are Using the API
SaaS Report Delivery
Your app generates a monthly statement or analytics export and delivers it as a secure, one-time link rather than an email attachment.
AI Agent Document Hand-Off
An AI agent drafts a contract, a quote, or a report and hands it to the end user through a secure channel without your team touching it.
Automated Onboarding Packs
Onboarding or KYC flows that dispatch personalised document packs to new customers securely and with uploads, downloads and API sends logged.
Back-Office Automation
Replace the intern who forwards sensitive PDFs by email. Cron jobs and workflow tools call the API instead, keeping a clean audit log.
Invoice and Payslip Delivery
Payroll and billing systems that currently attach PDFs to plain emails can send each recipient a unique, self-destructing link instead.
Regulated Document Distribution
Any flow where a professional must demonstrate that a specific document was collected at a specific time, and that FileSeal retained no copy.
Build It Yourself vs FileSeal API
The honest tradeoff between rolling your own one-time-link infrastructure and using the API.
| Capability | DIY Infrastructure | FileSeal API |
|---|---|---|
| Client-side AES-256 encryption | Must build | Built in |
| One-time download enforcement | Must build | Built in |
| Auto-delete after download | Must build | Built in |
| Audit trail per send | Must build | Built in |
| UK-only data residency | Depends on host | Always on |
| Time to first working send | Weeks | Minutes |
Frequently Asked Questions
Do recipients need an account or any software?
No. Recipients click the link in their email (or the link your app gives them), and the file downloads in their browser. No registration, no password, no app to install.
In zero-knowledge mode, can FileSeal read the file?
No. In the default link mode the AES-256 encryption key lives only in the URL fragment, which is never sent to the server. FileSeal stores ciphertext it cannot decrypt. Your application or agent is responsible for passing the complete link (including fragment) to the recipient.
Do I use the REST API or the MCP server?
Both do the same thing. Use the REST API if you are calling from a backend service, a cron job, or a workflow tool. Use the fileseal-send MCP server if you are building with an AI assistant or agent that supports the MCP protocol over stdio.
Further Reading
Guides on secure file delivery, AI agent workflows, and GDPR-compliant automation.
How to Send a File From an AI Agent: A Secure MCP Tutorial
Give an AI agent a tool to deliver a file as a one-time, AES-256 encrypted, auto-deleting link. Step-by-step setup for the FileSeal MCP server and REST API.
'Get a Link' vs 'Email Them': Which Should You Choose?
Both delivery options are encrypted. One is zero-knowledge, so not even FileSeal can open the files. The difference in plain English.
GDPR Document Compliance Guide
What GDPR says about document retention, deletion, and transfer, and how to build a compliant flow.