Skip to content
ReceiveVault
Log inRequest an invite

Stop emailing Start requesting them safely.

One secure link. Your client uploads from any device, no account needed. Virus-scanned, encrypted, and stored in Canada.

Request an inviteSee how it works

Free until February 28, 2027 · Invite only · No card needed

Canadian company. Canadian-owned servers. Your clients’ files never touch US-controlled infrastructure.

See it in action

Guided ID photosGuided capture waits for a sharp, glare-free photo before it is sent.

Built for the way you actually work

I'm a…

Sound familiar?

My client just emailed me their SIN, their T4, and a photo of their passport. In one email.

  • Send one magic link, collect SINs / T4s / pay stubs / ID in a single intake. No app, no account, no friction for the client.
  • Files virus-scanned, encrypted at rest, audit-logged with who-sent-what-when.
  • Pre-built request template for residential mortgage purchase and refinance. Start in under a minute.
  • Send commitment letters and closing packages back through the same portal - no second tool, same audit trail.
How it works

Three steps. No software for your client.

1

Create a request

List the files you need. Start from a ready-made template or build your own checklist - it adapts to whatever you collect.

2

Your client gets a magic link

One email, one click, no account. They see a tidy checklist on a page branded as your firm, not ours.

3

Files land in your dashboard

Each one is scanned for viruses, encrypted at rest, and added to the audit log so you know who sent what when.

Data sovereignty

A Canadian datacentre is not the same as a Canadian company.

The US CLOUD Act lets US authorities compel a US-based provider to produce data it controls - including data sitting on servers in Toronto. Picking a tool with a Canadian region does not settle the question. Who owns the provider does.

A US tool with a Canadian region

  1. Provider
    US company
  2. Servers
    In Canada
  3. Who can compel it
    US authorities, directly

Data residency. The files are in Canada, but the company holding them answers to a US court.

ReceiveVault

  1. Provider
    Canadian company
  2. Servers
    Canadian-owned, in Toronto
  3. Who can compel it
    Canadian courts

Data sovereignty. There is no US-owned company in the custody chain of your clients' files.

ReceiveVault is hosted in Toronto, on a Canadian provider, under Canadian law: servers owned and operated by a Canadian hosting company, for a Canadian company. Your clients’ files are handled under Canadian legal process - PIPEDA, provincial privacy law, and Quebec Law 25.

To be precise

No provider is beyond all legal process. Canadian courts can compel production, and governments cooperate through treaty channels. What changes is whose law and whose courts, and that no US-owned company holds your clients' files. Email notifications leave through easyDNS, a Canadian mail relay, and then reach each recipient's own email provider; file contents never leave Canadian infrastructure.

Read the full explainer: does the US CLOUD Act reach your clients' files?

Also in this series: PIPEDA and US-owned tools, Quebec’s Law 25, law society guidance, and the twelve questions to put to a vendor. See all guides.

Security

The boring parts, done properly.

Scanned before you open it

Every upload goes through ClamAV and is held until it comes back clean. Infected files are quarantined and you get an alert.

Encrypted, with a deletion date you set

Files travel over TLS and are stored with server-side encryption. Every request carries a deletion date you choose.

Every action logged in plain language

Who sent the request, who uploaded, who downloaded, and when. The activity log reads like a sentence, not a server log, and it is exportable.

FAQ

Common questions

Where are the files stored?+

On S3-compatible object storage with server-side encryption, running on servers owned and operated by a Canadian hosting company on Canadian soil. Files are never copied to third-party clouds, and no US-owned provider sits in the custody chain.

Does the US CLOUD Act reach my clients’ files?+

A CLOUD Act order is served on a provider subject to US jurisdiction. The application, the database, and your clients’ files all run on infrastructure owned and operated by a Canadian company, so there is no US provider in that chain to serve. Files are subject to Canadian legal process instead. No provider is beyond all legal process - Canadian courts can still compel production - but whose law applies is the part you get to choose.

What happens to files after the request expires?+

Every link expires, and you choose when. Each request link carries an expiry you set when you create it (30 days by default, up to 90), and outbound deliveries carry one you set per send. Once a link expires the magic link stops working. Files you received stay in your dashboard until you delete them or their retention window passes: 90 days from the request's last activity by default, or whatever window you set, up to one year at most. Files you send out are deleted 30 days after the delivery expires. This is a transfer service, not a document archive, so keep your own copy of anything you need to retain.

Is this PIPEDA / Quebec Law 25 compliant?+

The product is built with PIPEDA, PHIPA, and Quebec Law 25 expectations in mind: minimum-necessary collection, audit logging, encryption, expiry, and hosting with a Canadian-owned provider on Canadian soil. Compliance is ultimately your responsibility, but the technical building blocks are here.

Is it free during the private beta?+

Yes. Invited accounts get every feature free while the private beta runs, and no card is needed. Request an invite from the signup page.

Can my clients reply to the magic-link email?+

Yes. Invite emails go out with your email address as the reply-to, so your client can ask a question and it lands in your inbox like a normal reply.

How are accounts and client pages protected?+

Every account can use an authenticator app, hardware passkeys (YubiKey, iCloud Keychain, Windows Hello), and recovery codes, and destructive actions ask for your password again. The pages your clients see carry no advertising or analytics trackers.

Why not just email it?

How it compares with email and the usual file-sharing links.

  • Client needs an account
    ReceiveVault
    No
    Email
    No
    Dropbox / WeTransfer
    Sometimes
  • Virus scan before you open it
    ReceiveVault
    Every upload
    Email
    No
    Dropbox / WeTransfer
    No
  • Canadian-owned hosting
    ReceiveVault
    Yes - Canadian provider, outside US CLOUD Act jurisdiction
    Email
    Usually no
    Dropbox / WeTransfer
    No
  • Deletion date on every request
    ReceiveVault
    Yes, you set it
    Email
    No
    Dropbox / WeTransfer
    Varies by plan
  • Who-did-what log
    ReceiveVault
    Every action
    Email
    No
    Dropbox / WeTransfer
    Limited

Try it on your next intake.

Free until February 28, 2027. No card. Your clients never need an account.

Request an invite