Two-channel transfer
The data and the key never travel down the same channel. Whoever intercepts the envelope has no password; whoever reads along in the mailbox has no medium.
It is the principle of two-factor authentication, with the post and the telephone as the second channel. Explainable to a court clerk in one sentence, and still the first step to be dropped when time is short.
What are not two channels
One encrypted archive in an email, and the password in the email after it. A share link and the password in the same message. A stick with a note beside it in the envelope. Those are variants of a single channel: whoever has that channel has everything.
The second channel has to be physically different. Paper against network, or voice against text. A second email address of the same recipient does not count, because it runs over the same mail server and probably over the same signed-in device.
Two variants
Both usable. The choice depends on who is at the other end and on how much data has to move.
Medium by post, key by digital channel
You send encrypted USB sticks or drives by registered post, with advice of receipt. The password follows by telephone or by email.
Put a covering letter in the envelope explaining that the password is coming down another channel, and why. Without that letter the recipient calls the court registry to report that the stick is broken, and that costs more time than writing the letter.
Rates at bpost, from 1 January 2026: the registered-post supplement is €7.33 when franked with stamps or labels and €7.14 with a franking machine, a PB number or Collect&Stamp. That comes on top of the ordinary PRIOR rate. Advice of receipt costs €1.64 extra. Above 2 kg there is a flat rate of €33.00, up to a maximum of 10 kg. The current tables are on bpost’s rates page (in Dutch).
Link by digital channel, key by post
A secure shared folder by email, with the password in an ordinary letter that goes out the same day. For the shared-folder side of it, see Tresorit.
The same day is not a detail. Someone who gets a link he cannot open and then waits three days for a letter will call in the meantime, email in the meantime, and at some point simply ask for the password by email. The separation then fails on logistics rather than on technology.
A short formal letter on letterhead is enough: case number, parties, your identity block, and the password in a boxed frame. That frame is there to stop anyone taking the password for a reference number, and it stands out when the letter later turns up scanned somewhere it should not be.
Encryption that also opens at the other end
At the other end sits a court registry, a law firm or a technical adviser, and you rarely know beforehand on which system. The strongest encryption is worthless if the recipient cannot get it open.
BitLocker To Go. For removable media Windows encrypts with XTS-AES 128 by default. Windows 7 cannot read that algorithm, and neither can 8.1 without the necessary update. Those are exactly the machines still running at a court registry or in a small office. If you do not know the recipient, set AES-CBC through Computer Configuration → Administrative Templates → Windows Components → BitLocker Drive Encryption → Choose drive encryption method and cipher strength, or choose a container instead of full disk encryption.
The recovery key is a number of 48 digits, in eight groups of six. That is the part that must never end up in the case folder.
VeraCrypt container. Cross-platform and free, but the recipient has to install software. On the managed workstation of a law firm that often will not work. Ask beforehand.
7-Zip. The lowest threshold: 7z format, AES-256, and the Encrypt file names option switched on, -mhe=on on the command line. Without that option the archive’s table of contents stays readable, and in a case file the file names are often the most eloquent thing there is. A list of attachment names already tells a reader what the matter is about, even when not a single file opens.
Working rules
Use two different brands of media. One type means one production run, and therefore one possible batch fault. Two brands limit that risk and work on more systems besides.
Make redundant copies. With a faulty or unreadable medium you fall back on the second identical copy, without having to reconstruct the source material. A second stick costing a few tens of euros is always cheaper than redoing the extraction.
Label the medium so that it identifies itself. A volume label that becomes visible as soon as the medium is mounted, a colour code per recipient, and an overview sheet linking medium to addressee. With four sticks in a bag that is the only thing preventing a mix-up, and a mix-up means party A is holding party B’s copy.
Confirm physical handover in writing. Have the court registry stamp exactly what you hand over, or have your registered consignment signed for. Without that paper the delivery does not exist, and the argument about it comes up when nobody remembers any more who got what.
Keep the recovery keys outside the case file. A recovery key that ends up in the case folder, certainly in a folder that syncs with the cloud, cancels the encryption. Keep them in a password manager or offline.
Do not write the password out in the source file of your letter. The same rule, one level down. The text document of the covering letter sits in the same case folder as the data, and then key and data travel together after all, on your own disk instead of through the post.
High sensitivity: deliver the media yourself. Post and courier are then not appropriate. Record that choice and the reason for it, because it accounts for the time lost and the travel costs in your statement of costs.
What goes into the report
Which media, which encryption, how many copies, down which channel each part was sent, and to whom. That is your proof of delivery at the same time.
Write it as a table per addressee. When a party later claims to have received nothing, that overview together with the signature sheet of the registered consignment is all you need.