Field guides, threat reports, and compliance walkthroughs.
Written by the SEND-SECURELY.COM engineering, security, and compliance team — for the people who have to defend a control set under audit.
25 articles, newest first
- Announcement
Series C: $80M to bring US-only secure file transfer to every regulated team
Why we raised, what we'll build, and a thank-you to the customers who got us here.
- Field guide
Inside our incident response playbook — and the tabletop exercise that changed it
The original playbook, a synthetic tabletop scenario, and the two assumptions it broke.
- Buyer's guide
FedRAMP Moderate vs High for file transfer: a buyer's decision tree
What's actually in the control delta, realistic ATO timelines, and a decision tree by data classification.
- Engineering
Why we deprecated TLS 1.2 — and what that meant for one in nine of our customers
The decision, the 90-day customer-communication runbook, and the legacy AS2 integrations that broke.
- Threat report
Quarterly threat report: Q4 2025 — info-stealers and the new BYOD file-share problem
Info-stealer malware families we're tracking, how stolen browser sessions reach vendor portals, and the defenses that work.
- Year in review
2025 in review: regulated file transfer turned a corner
The numbers from the year, three customer-side shifts we didn't expect, and what we're focused on in 2026.
- Compliance
SOC 2 Type II + ISO 27001 + ISO 27701: what the combination actually proves
What the combination of SOC 2 Type II, ISO 27001, and ISO 27701 actually proves — a buyer's-guide explainer.
- Product
Recipient verification at the boundary: cutting accidental disclosure by 80%
The misaddressed-link problem, our boundary-verification model, and how the 80% number is measured.
- Threat report
Quarterly threat report: Q2 2025 — OAuth abuse in B2B file workflows
The pattern, defensive controls that actually moved the needle, and what to watch in your audit log.
- Compliance
NIST SP 800-171 Rev. 3 is final — what your file-transfer stack has to prove
What changed in Rev. 3, the control families that touch file transfer, and the evidence your CMMC assessor will request.
- Engineering
Engineering deep-dive: how we shave 80 ms off every resumed large-file upload
Where the latency hid, what we changed, and a representative benchmark.
- Threat report
Post-mortem reading list: what the 2024–2025 breach wave teaches us about vendor file transfer
Three categories of supply-chain compromise we keep seeing — and the defenses that actually work.
- Engineering
US-West is live: inside our second US data residency region
Why we built a second US region, the architecture trade-offs, and what changes for customers running multi-region.
- Vision
Why we joined the Coalition for Secure AI — and what it means for file transfer
Why a file-transfer vendor cares about AI security, and the three things we'll contribute to CoSAI.
- Buyer's guide
Migrating off legacy managed file transfer: a 30-day playbook
What we've learned helping security teams retire on-prem MFT tooling — without breaking the partner integrations they depend on.
- Field guide
Field guide: zero-knowledge vs server-side encryption for regulated workloads
Two architectures, very different operational consequences. A practical decision matrix for buyers.
- Threat report
Quarterly threat report: Q4 2024 — credential stuffing against vendor portals
What we saw in customer telemetry across Q4 2024, what's working defensively, and what to watch in Q1.
- Year in review
2024 in review: what 1.4 billion file transfers taught us about regulated data
A year-end retrospective on the patterns we saw across customer transfers, threats, and audit conversations.
- Field guide
Why 'password in a separate email' isn't secure file transfer
The mailbox-compromise threat model — and why one mailbox compromise compromises both.
- Compliance
How we think about SOC 2 readiness — and the five criteria we'd add to ours
What we focus on in our SOC 2 readiness program — and the five criteria beyond the AICPA TSC minimum that we'd voluntarily include.
- Event recap
Field notes from RSA Conference 2024: the secure-transfer conversations vendors aren't having
Three under-discussed themes from our week at Moscone — and one we didn't expect.
- Compliance
What changed in HIPAA's 2024 Security Rule update (and what your file-sharing stack needs to do about it)
A practical walkthrough of the 2024 NPRM updates and the file-handling controls they imply.
- Vision
Shadow IT isn't a people problem — it's a procurement problem
Why telling employees to 'use the approved tool' fails — and what a procurement-first approach looks like.
- Engineering
Why we built customer-managed keys into every paid plan
BYOK shouldn't be a Premium tier. Here's the engineering and business reasoning behind moving it down-market.
- Product
Our new audit log: every action, every actor, every byte
What we changed about evidence collection — and why it cuts evidence-prep time for SOC 2 audits by 60%.