Protect each recipient’s PDF with an access code

Switch the document to Secure link

Protection starts with the delivery. On the campaign’s Attachments card, under your personalized attachment, set Delivery to Secure link. The email then carries a personal link instead of the PDF, and nothing sensitive sits in the inbox. New documents start on Secure link unless your admin changed the account default.

Placing the link, setting how long it works and what the recipient sees are covered in Send documents by secure link. The rest of this guide is about the lock on the door.

Ask for an access code

In What the recipient answers, open Choose a field and pick Access code we generate. When the campaign is sent, Mailsoftly creates a different code for every recipient:

• Eight characters, shown as XXXX-XXXX, from letters and digits that cannot be confused, so there is no O next to a 0 or an I next to a 1
• Capitals and dashes do not matter when the recipient types it, so reading it over the phone is easy
• Stored encrypted, so your team can read it back later, and replaced by a new code every time you resend the link

The card’s own advice is the rule to keep: give the code to people another way, by phone, in a letter or in a separate message, and never put it in the same email as the link. Step 5 covers how.

Add a detail on file, or use one instead

You can ask for up to two things, and every one you choose must match. Next to the access code, or instead of it, the list offers details from the contact record:

• Date of birth, Postal code, Mobile phone and Work phone
• Any custom field of your account, such as a Membership ID you issued, like MB-40517

Name and email are never offered, because they sit on the envelope of the email already. The value a recipient has to type is the one on their record when the campaign was sent; changing the contact afterwards does not change what their link accepts. A recipient with no value in a chosen field is skipped rather than sent a question they cannot answer, and the card tells you how many before you send.

One kind of field is refused on purpose. If any of your signup forms writes to a field, the card names the form and says, for example, "Chapter cannot be used: your form "Membership signup" writes to it, so anyone could set the answer themselves." Whoever fills in that form could type any value and then answer your question with it, so the field proves nothing. The same check runs on automation steps, on the account defaults and again at send time.

Good questions are things the person knows and a stranger with their email does not: an ID you issued, a date of birth. Pairing the access code with one detail on file is the strongest setup, because a forwarded email alone gets nobody in.

Lock the downloaded file with the code

Once Access code we generate is one of the fields, a checkbox appears under it: Also lock the downloaded file with this code. Its help line explains the trade: "The PDF itself asks for the code when it is opened, so it stays protected on their device and if it is forwarded. It cannot be shown in the page, only saved."

• The PDF password is that recipient’s own access code, nothing else, so they type the same code twice: once on the page and once to open the file
• The file is encrypted with AES-256. Printing is allowed; editing and copying text out are not
• The document page shows no preview, only the Download PDF button and the line "The file is locked with your access code. Download it and enter the same code to open it."
• The lock is applied at the moment of download. If it cannot be applied, the download is refused; a locked link never hands out an unprotected copy

The choice is copied onto every link when the campaign is sent, so changing the checkbox later does not change links already out. An admin can make it the default for every new send with Lock downloaded files with the access code by default. If you do not see the checkbox after choosing the access code, contact support.

Deliver the code by another road

The code protects nothing if it travels with the link, so it needs a second road. Read it out by phone, print it in a letter, or send it automatically with the tag {(secure_document_code)}, listed in the merge tag menus as Secure document access code.

• Put the tag in an SMS, or in a separate email: another campaign, or an email from an automation
• It fills in with the person’s current code, from their most recent link that uses one and still works, so send the document first and the code message after it
• It is left out of any email that itself carries a secure link. If you put it there, the card warns: "This email contains the access code tag. A code sent with its own link protects nothing, so it will be left out. Send it in a separate message."

Contacts without a current code are skipped, so nobody receives a message with a blank where the code should be, and the send confirmation says how many. To send to them anyway, give the tag a fallback, {(secure_document_code OR "please call our office")}, or wrap the sentence so it only appears when there is a code:

{(IF secure_document_code)}Your access code for the renewal letter we emailed you: {(secure_document_code)}{(END)}

Read a code to someone who calls

People lose messages, and the fastest fix is often a phone call. The Secure documents page, under Campaigns in the sidebar, and the Secure documents tab on each contact show the code in the Recipient confirms column while the link still works. After a link stops working the column shows "No longer valid" instead.

The code is shown only to teammates who may act on that link: admins, teammates allowed to manage users, the person who created the send, and whoever issued the link. Everyone else sees the row without the code. Codes are never included in contact exports.

When you resend a link, a new code is made and shown straight away under New access code, with the reminder "Pass this on by phone or in a letter, not by email." Track and resend secure documents covers the page and the resend in full.

Understand wrong answers and lockouts

A wrong answer brings the page back with "Those details did not match what we have on file. Please check them and try again." The page never says how many tries are left. After the limit, 5 wrong answers unless an admin set anything from 3 to 10, one of two things happens, depending on the account setting After the limit:

• Lock the link for good, the default. The recipient sees the neutral "This link can no longer be used" page from then on
• Pause for 24 hours, then one more round; lock for good after a second lockout. While paused, the page tells the person when they can try again

A lockout sends an alert email, "A secure document link was locked", naming the contact and the document and saying how long the stored document stays available, with an Open contact button. It goes to the person who created the send, to all admins unless that switch is off, and to up to 10 extra addresses an admin adds. Nobody can switch the alerts off entirely.

A locked link cannot be unlocked. Confirm who the person is, then use Review and resend: it sends a new link with a new code and closes the old one.

The limit, the lockout mode and the alert addresses are account settings under Settings, Security, Organization security, in the Secure document links row.

Know what is not possible

Planning is easier with the edges drawn clearly. None of these exist today, and each has a way around it:

• A password on an attached PDF. Send the document by Secure link and use the access code instead
• A contact field, such as a date of birth or a member number, as the PDF password. Ask for it as a question on the page, and lock the file with the access code
• A password you type yourself, or one shared password for a whole send. Every recipient gets their own generated code, which is stronger
• Sending the code automatically without a message of your own. Place {(secure_document_code)} in an SMS or a separate email
• Name or email as a question, or more than two questions. Pick one or two details only the person would know
• Unlocking a locked link or turning a turned-off link back on. Use Review and resend for a fresh link and code

With the access code on the page and the lock on the file, the document stays protected from the inbox to the recipient’s desk. Send documents by secure link covers the rest of the delivery, and Set your organization security rules covers the other rules an admin sets for the whole account.