Overview
A government transfer is not complete when the file arrives. It is complete when you can prove who sent what, who received it, and what happened next — and most transfer receipts stop at delivery.
What government transfer actually requires
Public-sector exchange adds constraints that a commercial file-transfer tool rarely sees: sender and recipient identity, classification, integrity, a receipt, a record, and a path that works when the network is constrained or air-gapped. The transfer path must be documented before the exchange, not after the incident.
Encryption protects the file in transit; it does not tell you what the recipient did after decryption. A delivery receipt proves the package arrived, not who read which page. The receipt proves arrival; it does not prove reading.
A transfer record should connect the document, the parties, the classification, the time, and the delivery evidence. A receipt without identity is a timestamp with no owner. A hash proves integrity; it does not prove authority.
- Identity — sender, recipient, organisation.
- Classification — what the file is allowed to contain.
- Evidence — receipt, hash, access, retention.
Where transfer receipts stop
Most transfer tools stop at delivery: bytes sent, bytes received, checksum. That is useful for integrity and useless for custody. The recipient now has a file, and your policy no longer applies. The recipient's device is outside your administrative boundary from the first byte. The file is now a copy with its own lifecycle.
Revocation is the first gap. A sent file cannot be un-sent; a transfer receipt cannot revoke a copy. The second gap is page-level visibility: the tool knows a file moved, not which pages were read. A revocation button that only works before delivery is not revocation.
Government workflows often need both: a transfer path for large or low-sensitivity packages, and a custody path for CUI, procurement, citizen data, and legal files. A receipt is not custody; it is one link in the chain. The chain needs a handoff record, not only a delivery receipt.
When transfer must become custody
Custody starts when the recipient reads inside your control: server-side rendering, per-page watermarking, live revocation, and an audit trail that links the session to the page. Custody is a rendering decision before it is a policy decision. The original stays on the server; the session stays in the log.
For CUI, procurement, and citizen records, the question is not whether the file was encrypted in transit; it is who can still read it after delivery, and what evidence remains. If the agency cannot answer who read page 12, the transfer was not controlled.
The NIST SP 800-207 access model is a useful reference for the policy decision behind that control. The policy decides; the viewer enforces; the log proves.
- CUI and defense — the enclave keeps the original.
- Procurement — bidders read without downloading the pack.
- Citizen records — access is scoped, logged, revocable.
- Legal and oversight — page-level evidence, not just delivery.
Decision matrix
Start with the recipient question: does the partner need the file to process locally, or only to read it? The first is transfer; the second is custody. Write the recipient question down before the demo.
Use transfer for large, low-sensitivity packages, scheduled feeds, and partners with their own repository. Use custody for CUI, bids, board packs, citizen data, and any workflow where revocation matters. A hybrid is common; the mistake is calling it a single control. The document class decides the path.
Test both paths with the same document. If the transfer receipt is the only evidence you can produce, the workflow has a gap. The test should include the failure path, not only the happy path.
- Transfer — file moves; receipt and hash.
- Custody — pages render; session and watermark.
- Hybrid — raw data by transfer, decisions by custody.
- Evidence — who, what, when, what happened next.
Checklist before the next exchange
Ask for a live revocation test, an audit export, and an air-gapped path. A transfer demo and a custody demo answer different questions. Bring a real package and a real recipient. If the vendor cannot show the failure, the control is a claim.
- Parties — identity and organisation verified.
- Classification — what the file may contain.
- Control — revoke, watermark, log, expire.
- Records — retention and export.
Government transfer is a chain, not a button. Choose transfer when the file must travel, and custody when the document must be read without leaving. If you are mapping a government exchange, request a demo and bring one real package. For the model comparison, see secure file transfer vs secure document sharing; for the public-sector context, see document security for government; for the evidence chain, see digital chain of custody. A receipt is the beginning of the evidence, not the end.