Guide

Overview

TEPHIA SECURE is a service for exchanging confidential files in encrypted form. It is built for professions bound by confidentiality, such as tax advisers, law firms and notaries, and for anyone whose files should not sit unencrypted in other people's mailboxes.

What you can do with it

• Send files: you upload files and pass on a download link and a password. See Sending files.
• Request documents: an upload box accepts files from clients, who need no account. See Upload box.
• Keep proofs of delivery: every download is recorded. For the client file, you create a proof of delivery as a PDF. See Proofs.
• Work from Outlook: with the Outlook add-in you send files and request documents without opening the application. See Outlook add-in.

End-to-end encryption in plain words

For every transfer, your browser creates a random password. It uses this password to encrypt the files before they leave your computer. The server only holds encrypted data and never stores the key. The files are decrypted again only in the recipient's browser.

Without the password, nobody can open the files — not even the operator of the service. This is also why a lost password cannot be recovered.

What the server sees and what it does not

The proof of delivery needs this information. You will find it under Proofs.

Roles

Recipients and clients need no account. They download files via a link or upload them to an upload box. What they see is described under For recipients.

Layout of the application

After signing in, you see the sections Send file, Upload box and Proofs of delivery at the top. At the top right is a button with your email address and your organisation. It opens the account menu with Account, Help and Sign out. Owners and administrators also find Administration there.

If there is something important for your organisation, such as an outstanding contract, a notice bar appears below the navigation. It only ever shows the most urgent notice. Further notices expand with “+1 more”, “+2 more” and so on.

On every screen, a link such as Help with sending takes you straight to the matching chapter of this guide.

At the bottom left, How does this work? opens a short overview. It also shows the largest possible file and the download period.

Signing in

You sign in on the start page https://tephia.com. On the right is the card Sign in with three tabs: Microsoft, Password and Passkey. When the page opens, Microsoft is selected. Your organisation decides which method applies to you.

With Microsoft (business account)

1. Choose the tab Microsoft if it is not already selected.
2. Click Sign in with work account.
3. Sign in with your Microsoft work account as usual.

In this case your password and second factor are managed by your organisation in Microsoft 365, not by TEPHIA SECURE. Personal Microsoft accounts are not permitted.

If you see a message that no access is set up for your address, ask your administrators for an invitation.

With email address, password and code

1. Choose the tab Password.
2. Enter your Email address and Password and click Continue.
3. Enter the six-digit Code from your authenticator app and click Sign in.

If something is wrong, the message is always the same: “Sign-in not possible. Please check your email address, password and code.” That way the form does not reveal which part was wrong. After too many failed attempts the account is locked for a few minutes.

With a security key or passkey

1. Choose the tab Passkey.
2. Click Sign in with security key or passkey.
3. Confirm in your browser's window with your PIN, fingerprint, face or a touch of the key.

No password and no code are needed. You must have registered a key or passkey, for example a YubiKey, Windows Hello, Touch ID or Face ID.

Setting up access for the first time

Your administrators invite you. You receive an email with the subject “You have been invited to TEPHIA SECURE”. The invitation is valid until the date given in the email.

Click Set up access in the email. The page offers what your organisation allows: if it signs in with Microsoft, click Sign in with Microsoft and sign in with your work account — that sets up your access. Microsoft does not allow sign-in for a shared or functional mailbox; the page points this out, and you then set up a password. For your own password:

1. Choose a New password and repeat it. It must have at least 12 characters and must contain neither the part of your email address before the @ nor the name of your organisation or of TEPHIA SECURE. Common or leaked passwords and simple patterns such as “Password2024!” or “qwerty123456” are rejected; several random words or a password from a password manager work well. Click Continue.
2. Under Choose your second factor, pick Security key or passkey (recommended) or Authenticator app.
3. For a key or passkey, your browser asks you to confirm. After that you are signed in straight away.
4. For the app, scan the QR code, for example with Microsoft Authenticator or Google Authenticator. If you cannot scan, copy the Key shown into the app. Then enter the six-digit code and click Finish setup.

You can add the other factor later under Account.

Forgotten your password

1. In the tab Password, click Forgotten your password?.
2. Enter your email address and click Request link.
3. Open the email “Reset password” and click Set a new password. The link is valid for two hours.
4. Choose a new password.

Your second factor stays unchanged. You still need your code or key to sign in.

Lost your second factor

If you no longer have access to your authenticator app or security key, contact your organisation's administrators. They can reset your access. The note at the bottom of the Password tab reminds you of this too. There are no recovery codes.

You then receive an email “Your access has been reset” with the button Set up access again. The link can be used once and only for a limited time. You then set a new password and second factor, just as in the first setup.

If you sign in with Microsoft, your IT department can help you in Microsoft 365.

Signing out

Click the button with your email address at the top right and choose Sign out in the account menu.

Sending files

A transfer consists of one or more files, a download link and a password. You pass on the link and the password to the recipient by separate channels.

Choosing and uploading files

1. Open Send file.
2. Drag files or whole folders onto the area Drag files here. Alternatively click Choose files or Choose folder. “Choose folder” triggers a security prompt from your browser; dragging a folder in does not.
3. Several files or a folder are bundled into one ZIP in your browser. Use the cross to take a file off the list again.
4. Enter a Label (optional), for example the file number. It appears in the status view, the log and the proof of delivery. The recipient receives the ZIP under this name.
5. Click Encrypt and create link. Keep the page open until File encrypted appears.

Depending on your plan, each transfer can be up to 500 MB (Starter), 1 GB (Team) or 2 GB (Business and Enterprise), 100 MB during the trial. The limit applies to the whole ZIP. Large files are encrypted and uploaded in blocks; if the connection drops briefly, the page resends only the affected block. Your plan also limits the number of transfers per day and the storage in use. If a limit is reached, the page shows a message.

After uploading: link and password

The page reports File encrypted and shows below it until when the transfer can be downloaded. Two steps follow:

1. Pass on the link: choose how the link reaches the recipient: TEPHIA SECURE sends it, Your email app or Pass it on yourself. Your browser remembers your choice for next time.
2. Password by a different route: here you find the password with a copy button. It was created by your browser. It exists only on this page; the server does not know it.

Have TEPHIA SECURE send the link

This way TEPHIA SECURE sends the link to the recipient, and the address is recorded in your proof of delivery.

1. Under Pass on the link, choose TEPHIA SECURE sends it.
2. Enter the Recipients' email addresses. Separate several addresses with a comma, semicolon, space or Enter; each one appears as a separate tag that you can remove with ×. Invalid addresses are marked in red. If the page suspects a typo in a common email domain, such as two swapped letters in gmail.com, the address is marked in yellow and shows the suggestion as a button, for example gmail.com?. Clicking it applies the suggestion.
3. Optionally click + Add a message and write a Short message (optional).
4. Click Send link. With several addresses, the button reads Send links (N), with the number of addresses. If an address marked in yellow is among them, the first click does not send yet but reports “Please check the addresses marked in yellow. Clicking again sends anyway.” Only the second click sends.
5. If an address could not be sent to, it stays in the field and the message tells you why, for example “…: not a valid email address”.

Each recipient gets their own personal link and can download once with it. The proof of delivery shows who downloaded the files. TEPHIA SECURE only sends the link, never the password. You pass on the password yourself, for example by phone or in a separate email.

Before sending, TEPHIA SECURE checks whether the domain of each address accepts email at all. If it certainly does not, the message reads “Emails cannot be delivered to …. Please check the address.” The address then stays in the field, and nothing is sent to it.

If the domain accepts email but the recipient's server rejects the email, for example because the mailbox does not exist, it comes back as undeliverable. TEPHIA SECURE evaluates this response: usually within a few minutes you receive an email “Undeliverable: email to …”, and under Proofs of delivery the transfer shows “undeliverable to …” in red. If the page after uploading is still open, send the link to the correct address there; otherwise send the files again. If no such message arrives, that does not prove delivery, because some mail systems discard emails silently.

To prevent sending from being misused for mass mailings, limits apply: 30 send operations and 50 recipients per user and hour, and 300 recipients per organisation and day. They apply to all links that TEPHIA SECURE sends, including for upload boxes. Once a limit is reached, the page reports “You have sent to an unusually large number of recipients in a short time. Please try again later.” or “Too many requests. Please wait a moment.” The remaining addresses are then not attempted and stay in the field.

Link and password in your own emails

Under Pass on the link, choose Your email app. Open email with link opens a prepared email in your email program; the password is not in it. Under Password by a different route, Send as a separate email opens a second prepared email containing the password. Enter the recipient in each and send the two emails separately. It is even safer to pass on the password by a different channel, for example by phone or messenger.

This shared link is valid for one download. Whoever downloads first gets the file.

Securing the shared link

With Pass it on yourself, the download link is shown for copying, for example into a messenger. If you pass the link on yourself like this, perhaps to several recipients, specify who may download:

1. Under Pass it on yourself, expand Only certain addresses may download.
2. Enter up to ten addresses in Authorised email addresses (up to 10), separated by commas, semicolons or spaces.
3. Click Release only for these addresses.

Each recipient confirms their address with a code sent by email when downloading, and may download once. Here too, TEPHIA SECURE first checks whether each domain accepts email and otherwise refuses with the message “Emails cannot be delivered to …. Please check the address.”; the addresses count towards the limits above. You can only switch this on as long as nobody has requested the file through the shared link. With “TEPHIA SECURE sends it” it is not needed — there each recipient already has their own link.

If the email with the code comes back as undeliverable, you are informed in the same way, by email and under Proofs of delivery. An authorised address cannot be removed again. If it was wrong, send the file again and authorise the correct address.

Validity, download and attempts

• Each recipient can download once. After that, the transfer is deleted from the server; with personal links, only once everyone has downloaded it.
• If unused, the transfer expires on the date shown under File encrypted after uploading and is deleted.
• Each recipient has three download attempts. If all fail, for example because of a wrong password, the transfer is blocked. Then send the files again.
• For every download, you receive an email “Downloaded: …”. You can see the status under Proofs and next to the form under Recent transfers.

Warning when leaving the page

If you have neither copied the password nor clicked Send as a separate email, the page asks before you leave: “You have not copied or emailed the password for this transfer yet. It exists only here — we do not know it. Leave the page anyway?”

If you leave anyway, the password is lost. The recipients cannot open the transfer, and you have to send it again.

Requesting documents (upload box)

An upload box accepts files from outside, for example from clients or the other party. The sender needs no account. Their files are encrypted in their browser with the upload box password before they are transferred.

Creating an upload box

1. Open Upload box. If you already have open upload boxes, click Create another upload box.
2. Enter a Label, for example “Miller matter”.
3. Optionally write a Note for the sender (optional). It appears on the page where your client uploads files.
4. Click Create upload box.

The page now reports Upload box is ready and shows the same two steps as after sending: Pass on the link and Password by a different route. At the same time TEPHIA SECURE sends the upload link and the password to your own email address, with the subject “Access details for your upload box …”. That way you can find the password again later. Send access details to me again sends the email once more.

Passing link and password to the client

Under Pass on the link, choose one of three ways. Your browser remembers the choice, for sending files too.

• TEPHIA SECURE sends it: enter the email address, optionally a short message via + Add a message, then click Send link. You can enter several addresses at once, separated by a comma, semicolon, space or Enter; all recipients upload to the same upload box. Yellow marking with a suggestion for suspected typos, the domain check and the limits work as described under Sending files. Only the link is sent, and the address is recorded in your proof of delivery. If the email comes back as undeliverable, you receive an email, and under Proofs of delivery the upload box shows “undeliverable to …” in red. Then send the link to the correct address; it is also in your email “Access details for your upload box …”.
• Your email app: Open email with link opens a prepared email in your email program, without the password.
• Pass it on yourself: shows the upload link for copying.

Under Password by a different route, the password is shown for copying. Send as a separate email opens a second prepared email for it.

Always pass on the password separately from the link, ideally by phone. What your client does next is described under For recipients.

Notification about new files

You receive an email “… new file(s) in upload box …” with the button Open upload box. It arrives as soon as your client clicks All files uploaded. If they do not click, it arrives automatically two hours after their first new file.

Downloading files

1. Open Upload box. The list shows your open upload boxes with the number of files, the size and the deadline.
2. Click Open next to the upload box.
3. Enter the Upload box password, for example from your access email.
4. Click Download next to a file. Your browser loads it, decrypts it and saves it.
5. With two or more files, Download all files is available. You then receive all files in one ZIP file.

Files you have downloaded are marked “downloaded”. Why you need a password even though you are signed in is explained by Why do I have to enter a password? next to the field: signing in opens the service for you, not the files.

Closed automatically

As soon as you have downloaded all files, the upload box closes automatically and its contents are deleted. After that, it no longer accepts files. Your client then sees a note asking them to request a new upload box.

Password gone

In the open upload box, click Where is the password?. It tells you when and to which address the password was sent. Your client also knows the password, because they needed it to upload the files. Ask them for it, but not by email.

If that does not help, Ask the sender again remains:

1. Check the Sender's email address(es). They are pre-filled with the addresses the link was sent to so far, five at most.
2. Adjust the Message to the sender.
3. Click Replace upload box and ask the sender.

Here too, TEPHIA SECURE first checks whether the domains of the addresses accept email and otherwise refuses with the message “Emails cannot be delivered to …. Please check the address.” A new upload box with a new password is created. The previous one is closed and its files are deleted permanently. You pass on the new password yourself. If one of these emails comes back as undeliverable, you are informed as described above.

Closing and expiry

• To close an upload box, click Close in the list. When asked “Permanently delete the upload box and its contents?”, click Delete.
• Each upload box is available until the date shown in the list. After that, it is closed automatically and its contents are deleted.

Proofs of delivery

Every transfer is logged without gaps: sent, link emailed, link opened, undeliverable, downloaded, uploaded to an upload box, downloaded from it. Under Proofs of delivery, you can see the status of your transfers and create a proof of delivery as a PDF for the client file.

Status and log

At the top, you choose the period: 30 days, 90 days (the default), 1 year or Everything. There are two views:

• The status view shows for each transfer whether it has been downloaded. It is what you see when you open the page.
• The log shows every single event with date and time, IP address and location. You open it with Full log below the lists.

Status

At the top are the tiles Open, Downloaded, Not downloaded and Upload boxes open, each with its count. Clicking a tile filters the lists accordingly: Upload boxes open shows only the upload boxes, the other tiles show only the transfers. Open also counts partly downloaded transfers. Clicking the same tile again shows everything. The search field next to the period finds labels, file numbers, file names and recipients.

Under Transfers, each transfer has one row with its state and the button Single proof. The states:

For each transfer, you also see when it was sent, who the link went to and who has already downloaded it. “link in the email opened” means that the download page was loaded via the personal link. In rare cases, an automatic scanner in the mail system can also cause this. Only the download proves receipt.

Under Upload boxes, you see for each upload box how many files have arrived and been downloaded, and whether it is open, all downloaded, closed, closed, expired, replaced or blocked after failed attempts.

If an email that TEPHIA SECURE sent to a recipient comes back as undeliverable, the row of the transfer or upload box shows “undeliverable to …” in red, with the address. This applies to links and to the confirmation code sent to authorised addresses. The note usually appears a few minutes after sending, sometimes only after hours. You also receive an email “Undeliverable: email to …” with the response of the receiving mail server, and the log shows the event Email undeliverable. Check the address and send again to the correct one. Not every mail system reports back: if there is no note, that does not mean the email has arrived. Only the download proves receipt.

Log

You open the log with Full log below the lists; ← Back to status takes you back. It lists all events in the selected period. Below the lists there are up to three text buttons: Full log (replaced by ← Back to status in the log), CSV export and, for owners and auditors only, Verify chain. CSV export downloads the events as a spreadsheet. Verify chain checks that the entries are unchanged. The result appears directly below the buttons, for example “The chain is intact: … entries, … of them emptied after the retention period.” or “The check found … irregularity/irregularities.” If the CSV export fails, the message also appears there.

Single proof as a PDF

Every transfer's row contains Single proof. It creates a PDF that contains exactly this one transfer. That way, no data of other clients ends up in a client file.

The proof of delivery contains:

• subject, transfer reference, the person responsible, organisation and date of creation
• the outcome in words, such as when and via which link the file was downloaded or that an email could not be delivered
• the contents of the transfer, with file names as given by the sender
• all events with date and time, parties, IP address and approximate location
• the check value, the address for online verification and a QR code
• the checksum (SHA-256) of each file and whether the recipient's browser confirmed it after decryption

The proof reflects the state at the time it is created. If something happens later, such as a download, create it again. Under Account, you can have it emailed to you automatically after every download.

Why the proof is reliable

• Hash chain: every event is cryptographically linked to the one before. If an entry is changed, removed or inserted afterwards, the chain breaks and this is detected.
• Signature and timestamp: the PDF is digitally signed. Any later change invalidates the signature. A timestamp from an independent authority proves when it was created.
• Chain seal: once a day, the state of all proof chains is secured in a signed document. The proof contains the data needed to recompute this.
• Verify online: at https://tephia.com/verify or via the QR code, anyone can check without an account whether a proof is unchanged. All that is needed is the transfer reference and the check value from the end of the PDF. Nothing is disclosed in the process. If you have the file itself, you can check it against the proof of delivery there; it never leaves your computer.

Who sees your transfers

Normally, you only see your own transfers. If your organisation has switched on shared visibility, owners and administrators see the transfers of all users. The auditor role always sees them. Whoever has this visibility chooses between My transfers and Entire organisation in the selector before the period.

In that case, all users see this sentence below the heading Proofs of delivery: “Transfers of all users in your organisation are visible to administrators and to the auditor role.”

At the bottom of the page, you can see how long your organisation keeps proofs of delivery. Older entries are emptied of their content; the chain remains verifiable.

Account and security

Under Account, you manage your sign-in and set up automatic proofs of delivery. You open it from the account menu: click the button with your email address at the top right and choose Account.

The page has two groups: Sign-in and Notifications. Each card first shows the current state. The form below it only appears when you click Change or Add. Which cards appear depends on whether you sign in with Microsoft or with a password.

Sign-in with Microsoft

If you sign in with your Microsoft work account, there are no settings here for your password or second factor. You manage them in your Microsoft account under “Security info”. The button Open Microsoft security info takes you there. If you get stuck, your IT department can help.

Change password

1. In the Password card, click Change.
2. Enter Current password, New password and Repeat new password.
3. Click Change password.

You are then signed out everywhere. Sign in again with the new password.

Authenticator app

The card shows whether your sign-in is protected by an authenticator app. For a new phone or a different app:

1. Click Change in the card.
2. Enter Your password to confirm.
3. Click Replace authenticator app. If you have no app yet, the button reads Set up authenticator app.
4. Scan the QR code with the new app or copy the Key into it.
5. Enter the Code from the new app and click Confirm new app.

The previous app keeps working until the new one is confirmed. Cancel leaves everything as it was. After the change, your other sessions are signed out, and you receive an email about it. If the old phone is already gone, your administrators can reset your access; see Signing in.

Security keys and passkeys

A security key such as a YubiKey, or a passkey such as Windows Hello, Touch ID or Face ID, replaces the code from the app. It cannot be phished, because it only responds to the site it was created for.

To add one:

1. In the Security keys and passkeys card, click Add.
2. Optionally enter a Label (optional), such as “YubiKey on my keyring”.
3. Enter Your password (to confirm).
4. Click Add key and confirm in your browser's window.

The card shows how many keys are registered and lists each one with the day it was added and last used. Remove deletes a key. You cannot remove your last second factor. Ideally, set up a second key as a spare straight away. You receive an email for every new key.

Outlook add-in

If you sign in with a password, the Outlook add-in card shows how many sign-ins are active and lists every sign-in of the Outlook add-in, with “Signed in on”, “last used on” and “valid until”. Sign out ends one of them, for example for a computer you no longer use.

A sign-in lasts 30 days. It also ends when you change your password or second factor.

With Microsoft, the add-in usually signs in through your sign-in in Outlook; there is no list for that. If it signed in through its own sign-in window, for example for mailboxes on an on-premises Exchange Server, the sign-in is listed here; it lasts 7 days from the last use, 30 days at most. The link How to set up the Outlook add-in leads to the setup page. More under Outlook add-in.

Proof of delivery after download

This card is in the Notifications group. As soon as a recipient has downloaded a transfer, you are notified by email. On request, the full proof of delivery is attached as a PDF.

1. Tick Send the proof of delivery as a PDF automatically.
2. If the proof should go to a different mailbox, such as the one used for the case file, tick Different recipient and enter the Destination address. It must be on a verified domain of your organisation.
3. Click Save.

If your organisation has decided this for everyone, you will see a note instead of the choice.

Language and appearance

In the top right corner there are two controls:

• The language selector changes the language of the interface, for example to Deutsch, Français, Italiano or Nederlands. The page reloads.
• The round button with a moon or sun (Switch appearance) switches between light and dark.

Your organisation sets the language of proofs of delivery and notifications for everyone, regardless of your choice.

Outlook add-in

With the add-in you send files and request documents directly while composing an email. The ribbon then shows two buttons in the TEPHIA SECURE group: Send securely and Request documents. A task pane opens on the right. Encryption happens there; the files themselves do not travel through your email system.

The add-in runs in the new and classic Outlook for Windows, in Outlook on the web and in Outlook for Mac (there with mailboxes in Microsoft 365). It appears only while composing, not while reading. Your IT sets it up.

In Outlook on the web and the new Outlook, the add-in is under Apps in a new email. To keep it in the toolbar: in the Apps menu, right-click TEPHIA SECURE and choose Pin, or under Settings → Mail → Customize actions tick TEPHIA SECURE. If it is missing under Apps, sign out of Outlook on the web and back in once.

Signing in

The first time you open it, choose:

• Sign in with Microsoft (the main button): the add-in takes over your sign-in from Outlook. The first time, you confirm once briefly. Where Outlook does not offer this, for example for mailboxes on an on-premises Exchange Server, a window opens for the Microsoft sign-in; the sign-in then lasts 7 days from the last use, 30 days at most.
• Sign in with password (the link below it): a window opens. Enter your Email address, Password and Code from the authenticator app and click Sign in. The sign-in lasts 30 days for this Outlook.

If the window does not open, allow pop-ups for Outlook. At the bottom of the pane you see “Signed in as …” with Sign out. Your password, second factor and everything else are changed in TEPHIA SECURE in the browser.

Send securely

1. Create a new email and enter the recipients in To or Cc.
2. Click Send securely.
3. Drag files into the area “Drag files here or browse”, or click browse in it. Simply drag whole folders in; the pane has no button for choosing a folder. In total, each transfer can be as large as your plan allows: 500 MB, 1 GB or 2 GB, 100 MB during the trial.
4. The Label (optional) is pre-filled with the subject. It appears in the status view and in the proof of delivery and, with several files, as the name of the ZIP file.
5. Under Deliver the link, choose one of the two cards. Your choice is remembered for next time.
6. Click Encrypt and insert into the email.

The pane then shows with ticks what is done, for example “Password is in the email”. Once nothing is missing, the green box below says “All set. You can send the email now.” Show password reveals the password, Copy password copies it and Send more files starts over.

TEPHIA SECURE sends the link (recommended)

The card reads TEPHIA SECURE sends the link (“Recommended · own link per recipient”). The add-in inserts a box with the password into your email, so the password is in this email. Then send the email as usual.

Only when you send it does each recipient in To and Cc receive their own email from TEPHIA SECURE with a personal link. Each can download once with it; no confirmation code is needed, which is why the pane hides the code option for this card. The proof of delivery shows who downloaded. Recipients you add before sending get their link automatically. The link and the password thus arrive by two different channels. At most 20 links go out per transfer; with more recipients, the add-in reports “At most 20 recipients per transfer.” The add-in does not check the addresses in advance; if one cannot be delivered to, Outlook reports this for your email as usual.

The pane then shows “Password is in the email” and “Links go to … when you send”. If you discard the email, no links go out either. After about 30 minutes an email “Links not sent yet” reminds you. In older Outlook versions the links go out right after uploading; the pane then tells you to whom.

Link in this email

The card reads Link is in this email (“You pass on the password separately”, for example by phone or in a second email). The add-in inserts a box with the link into your email and at once opens a second email with the password to the same recipients. Send both emails. Open password email again brings it back; Copy password lets you pass it on by phone, for example. If the email has no recipients yet, the password email does not open by itself; the pane then shows “No recipients in the email yet — the password email opens without addressees.” and the button Prepare password email. With this card, the green box “All set. You can send the email now.” only appears once the password email has been prepared or sent.

If you are signed in to the add-in with Microsoft, or your mailbox is on your company's Exchange Server, no second email opens. Instead, the task pane shows recipients and text of the password email; change anything you need and click Send password email. The email goes straight from your mailbox and then appears under “Sent Items”. The first time, Microsoft may ask whether the add-in may send email as you; this applies only to these password emails.

With several recipients, everyone gets the same link. Each then confirms their address with a code when downloading and may download once. With one recipient, you can switch this on with Recipients confirm their address with a code. This checkbox only appears with the card Link is in this email.

Taking over existing attachments

If the email already has attachments, the pane offers Send the attachments securely instead. The attachments move into the file list and are removed from the email after uploading.

Request documents

1. Create an email to your client and click Request documents.
2. Check the Label (optional) and optionally write a Note for the sender (optional).
3. Under Deliver the link, choose one of the two cards as above.
4. Click Create upload box and insert into the email.

The password also goes to you, so that you can open the uploaded files later. The done view confirms this with “Password also sent to … – for opening the files later”. You download them in the browser under Upload box.

The check on sending

When you send, Outlook checks whether every recipient gets the link, the password and permission to download. If something is missing, Outlook holds the email and names the reason, for example:

• The password email has not been prepared yet.
• Someone gets the link but no password yet, for instance because they were added after the password email.
• Someone cannot download via the link yet.
• The password is no longer in the email.
• Sending the links on send failed.

Click Fix it now in the notice. The pane opens and catches up on everything in one step. Then simply send the email again. If your Outlook version has no such button, open TEPHIA SECURE in the ribbon and choose Fix it now there.

The pane shows the same points beforehand in the box Still open before sending. Once everything is done, the green box says “All set. You can send the email now.” Emails without a prepared transfer go through without a check.

The “mailto” prompt

Classic Outlook sometimes asks whether the add-in may open “mailto”. The pane then briefly reminds you what to do. Tick Remember my choice and choose Open. Outlook will then not ask again on this computer.

Your IT can also allow it for all computers in your organisation; Outlook then does not ask at all. How to do this is described in the administrator guide, chapter “Outlook add-in: policies and network”.

Technical details

If something hangs or fails, Technical details appears at the bottom of the pane. It lists every step with the time. Expand it and take a screenshot for your IT or support.

For recipients: downloading and uploading

This chapter is for everyone who receives files through TEPHIA SECURE or is asked for documents. You need no account and nothing to install. An up-to-date browser is enough.

Downloading a file

You receive the link by email, either directly from the sender or from TEPHIA SECURE with the subject “… has made an encrypted file available to you”, or “… has made encrypted files available to you” for several files. You receive the password separately from the sender, for example by phone or in a second email. TEPHIA SECURE never sends a password.

1. Open the link, for example with Download file in the email, or Download files for several files.
2. The page Download file shows the file name, size, sender, deadline and the remaining download attempts.
3. Enter the Password. Mind upper and lower case. It is safest to copy it in full.
4. Click Decrypt and save.

Your browser loads the file, decrypts it and saves it, usually in your downloads folder. Several files arrive as a ZIP. The page then reports: “The file has been decrypted and saved. It has now been deleted from the server.” It cannot be downloaded a second time, so keep the file safe.

Confirming your email address with a code

If the sender has specified who may download, you first see Please confirm your email address.

1. Under Your email address, enter the address the transfer is meant for.
2. Click Request code.
3. You receive an email “Your confirmation code for the download” with a six-digit code. It is valid for 15 minutes and only for this transfer.
4. Type the code into Code from the email. It is checked automatically after the sixth digit. Alternatively, click Confirm.
5. Then enter the password as above.

If no code arrives, check the spelling of the address and your spam folder. Request a new code sends a new one. For security reasons, the page always responds in the same way, even if the address is not authorised.

Download attempts

Every click on Decrypt and save counts as an attempt. You have three attempts. The page shows how many are left. Once they are used up, the file is blocked. Then ask the sender to send it again.

Other messages and what they mean:

What the sender learns

The sender is notified as soon as you have downloaded the file. Their proof of delivery contains the date and time, your IP address and the approximate location derived from it. They also see whether the link from the email was opened and whether your address was confirmed by code. Only you and the sender know the content of the file.

Uploading files to an upload box

If you are asked for documents, you receive a link to an upload box, for example in an email “… has asked you to send files in encrypted form”. The password comes separately from the person who asked.

1. Open the link, for example with Upload files. The page shows who you are uploading for and, if given, a note.
2. Drag files or folders onto the area or click Choose files or Choose folder. Each file is encrypted separately.
3. Enter the Password and click Encrypt and upload.
4. For more files, click Add more files. The password stays in the field.
5. When you are done, click All files uploaded. The recipient is then notified. If you do not click, this happens automatically two hours after your first file.

You can still add files later. Simply open the link again, as long as the upload box is open and the recipient has not yet downloaded the files. After that, it no longer accepts files, and you need to ask for a new upload box. After too many wrong passwords, the upload box is locked for you. Then contact the person who asked.

No email received?

Check your spam or junk folder. Link emails from TEPHIA SECURE carry the sender's name in the subject. If you find nothing, ask the sender.

Something looks suspicious?

At the bottom of the download and upload pages, there is Report misuse. Briefly describe what you noticed, for example an unknown sender or a request for payment. The sender will not find out who reported it.

Frequently asked questions

Passwords and links

I have lost the password of a transfer. Can you send it to me?

No. The password is created in your browser and stored nowhere. Nobody can recover it, not even the operator. That is the core of end-to-end encryption. Simply send the files again, with a new link and a new password.

And if the password of an upload box is missing?

Search your inbox for the email “Access details for your upload box …”. In the open upload box, Where is the password? helps. Your client also knows the password. As a last resort there is Ask the sender again; see Upload box.

The link has expired. What now?

An expired transfer is deleted and cannot be extended. Send the files again. For an expired upload box, create a new one.

Can I put the link and the password in the same email?

Please do not. Whoever intercepts that one email would have both. Use two channels, for example the link by email and the password by phone. The easiest way is to let TEPHIA SECURE send the link; see Sending files.

Recipients

The recipient cannot open the file.

Check with them:

• Did they enter the complete password with the correct upper and lower case?
• Have their three download attempts been used up? You can see this under Proofs. If so, send the files again.
• Has the file already been downloaded, for example by another recipient through the shared link?
• Has the deadline passed?
• Are they waiting for a confirmation code? Then they should check their spam folder.

The guide for recipients is under For recipients. You can send them the link to this help: https://tephia.com/help

A recipient address is rejected or marked in yellow.

The page marks addresses in yellow when it suspects a typo in a common email domain. The button next to it, for example gmail.com?, applies the suggestion. If the address is correct after all, click Send link a second time; it is then sent.

If the message reads “Emails cannot be delivered to …. Please check the address.”, the domain does not accept email according to DNS, usually because of a typo. Check the spelling or ask the recipient for their address. Addresses marked in red are not valid email addresses. More on this under Sending files.

Will I notice if a link does not arrive?

If the recipient's mail system rejects the email, yes: you receive an email “Undeliverable: email to …”, and under Proofs of delivery the row shows “undeliverable to …” in red. If it discards the email silently, nobody learns of it, and the transfer stays open. Only the download proves receipt with certainty.

Does the recipient need an account?

No. Downloading and uploading work without an account and without installing anything, just in the browser.

Files and technology

How large can a transfer be?

Depending on your plan, up to 500 MB (Starter), 1 GB (Team) or 2 GB (Business and Enterprise) per transfer, 100 MB during the trial. Several files or a folder are bundled into a ZIP that must stay below this limit as a whole. In an upload box, the limit applies to each individual file. Split larger amounts of data across several transfers.

Which browser do I need?

An up-to-date browser. Encryption happens in the browser itself, so no extension is needed. The page must be opened over https://; otherwise the browser does not provide encryption.

Does it work on a smartphone?

The pages run in the browser and therefore, in principle, on smartphones and tablets too. The file is encrypted or decrypted in the device's memory. For large files, a computer is the better choice.

The Outlook add-in is not available in Outlook on smartphones.

Data and retention

Where is the data kept?

The servers are in a data centre in Germany. The start page says more in the section “Where your data is kept”. The files are stored there in encrypted form only.

How long are files kept?

• A transfer stays on the server until it is downloaded, at the latest until its expiry date. The date is shown after uploading. After that, it is deleted.
• Files in an upload box are deleted as soon as you have downloaded them all, or when the upload box is closed or expires.
• Proofs of delivery are kept for as long as your organisation has specified. The period is shown at the bottom of the Proofs of delivery page. After that, the entries are emptied of their content; the chain remains verifiable.

Can the operator read my files?

No. The files are only stored on the server in encrypted form, and the key is never stored. What the server does see is described in the Overview.