My MX Data gives federal, state, local, tribal and education teams, government contractors, vendors and approved partners a controlled way to exchange sensitive files with named recipients. MX keeps access settings and activity evidence attached to each handoff, without relying on public links.
7-day trial | up to 5 users | no credit card required
Audits, Inspector General reviews, incident response and contractor oversight all test how information was handled. A secure exchange process should provide useful evidence without forcing teams to rebuild the story from email threads, screenshots and open links.
Named recipients make the access boundary clearer. MX associates the exchange with identified accounts instead of a public URL that can be forwarded, copied or left available after the task ends.
Time-stamped activity supports later review. Upload, access, download and restoration events can be captured with relevant account and technical details, subject to the configured workflow and retention policy.
Expiration and permission settings make access intentional. Teams can limit availability and recipient actions around the purpose of the exchange, then close the route when the work is complete.
Suitability requires an agency-specific assessment. MX provides technical controls and evidence. The agency or contractor remains responsible for data categorization, contract requirements, system authorization, export controls, records obligations and risk acceptance.
Use these guides to support data categorization, assurance and longer-term security decisions around sensitive file exchange.
Information that identifies the sender, recipient or business purpose is separated from the file data, so an individual fragment reveals less useful context.
The anonymized payload is split into encrypted shards and handled according to configured data-location options. A single shard is not a complete usable file.
After recipient verification, MX restores the file and records relevant activity to support operational accountability and later review.
ASR is not a claim of invulnerability or a substitute for an agency security program. It is a patented methodology designed to reduce exposure and make the handling process easier to document.
MX concentrates on the moment sensitive information moves between known parties. It can sit alongside records, collaboration and case-management systems while adding a controlled route for external and cross-agency handoffs.
Tie each exchange to identified accounts instead of an anonymous or broadly reusable link.
Capture relevant upload, access, download and restoration events for review, investigation and oversight.
Limit how long a file remains available and control recipient actions around the purpose of the handoff.
Choose available regions as part of the agency architecture, contract terms and data-handling assessment.
Require an additional identity check before access is granted to an account.
Move datasets, imagery, technical packages and media without splitting them or using personal transfer accounts.
Give the public, grantees, vendors and partners an approved route for submitting sensitive material.
Keep operational notes and conversation connected to the relevant file activity instead of scattering context across inboxes.
Microsoft 365, agency content systems and approved collaboration platforms can remain appropriate for daily work and records management. MX addresses exchanges that need named access, time-bound availability and clearer evidence.
The practical decision is which exchanges require additional control and evidence. Review MX's enterprise file-sharing approach for cross-agency and contractor workflows.
MX can contribute encryption, named-account access, event records, expiration controls and data-location options to a broader agency or contractor security program. It does not certify a system, issue an authorization to operate or make a workflow compliant by itself.
HIPAA
CCPA
SOX
GLBA
FISMA
FERPA
ITAR
CJIS
IRS Publication 1075
NIST SP 800-171Structured transfer records can reduce manual reconstruction during internal audit, Inspector General work, incident response and contractor reviews.
Named accounts, authentication and permissions help show how access was limited to approved participants.
Available region options can support architecture and contract requirements when assessed with the complete system.
The route from upload to recipient access can be described to privacy, security, records, legal, procurement and authorizing stakeholders.
Use MX when a file must leave the team that created it and the recipient, access conditions and evidence need to remain clear.
Share case material, procurement files, reports and operational records with approved accounts in another agency or contractor organization.
Explore controlled B2B exchangeProvide a branded upload route for applications, evidence, bid documents and supporting records instead of accepting fragmented email attachments.
Review secure upload portalsTransfer imagery, media, datasets, engineering packages and archives without steering staff toward personal accounts or consumer services.
See secure large-file transferUse these guides to support classification, assurance and longer-term security decisions around sensitive file exchange.
A routine spreadsheet can become sensitive once names, pricing, case details or controlled project information appear. Classify the risk before the file leaves the agency.
Read the guideLook beyond encryption to identity, auditability, retention, configuration and shared responsibility.
Read the guideUnderstand how separating and anonymizing data changes an attacker's problem.
Read the guideWhere MX fits, what its controls can support and which decisions remain with the agency or contractor.
My MX Data provides a controlled route for moving sensitive files between agencies, contractors, vendors and other approved recipients. Each exchange is associated with named accounts and can produce a detailed activity record.
MX combines AES-256 encryption with Anonymize, Shard, Restore. Administrators can also apply expiration dates, download restrictions and data-location options.
No service should make a blanket claim that it is appropriate for every government data category. Classified information requires approved systems and handling processes. CUI requirements depend on the category, agency contract, system boundary and applicable safeguarding rules.
Use the current NIST SP 800-171 CUI guidance and agency direction as part of the assessment. Do not assume suitability without the required authorization and contractual approval.
Responsible sharing starts with authority, purpose, minimization, records requirements and accountability. Technology supports those decisions but cannot make them for an agency. Named access, expiration, download permissions and activity records add control around the transfer.
The NIST Privacy Framework can help organizations structure privacy risk management alongside applicable federal and state requirements.
No. Those platforms can remain appropriate for productivity, collaboration, case work and longer-term content management. MX serves a narrower purpose: controlled, auditable handoffs between known accounts.
Agencies can keep content in approved systems and add an exchange-focused route where identity, time-bound access and evidence matter most.
MX can provide a branded secure upload portal or a named-account exchange route. External senders receive one approved destination, while the agency receives a more controlled record of the submission.
This can reduce attachment-based intake, open links and manual chasing across disconnected channels.
Depending on the configured workflow, records can include the sender, named recipient, upload time, access events, downloads, restoration activity, timestamps and relevant technical details.
That evidence can support audit, oversight, incident investigation and contractor review. Agency ownership, retention rules, logging integrations and records schedules remain essential.
Use the seven-day trial to evaluate named-account access, event records, large-file transfer and secure handoffs with up to five users.
Clear answers about File Sharing for Governments.
A business should assess file-sharing software against the actual risk and workflow around the information being exchanged. Different transactions can carry different conditions, so routine material does not need to be handled exactly like highly sensitive information.
Useful criteria include named-recipient access, strong authentication, permission controls, encryption, expiry settings, audit evidence, user administration, large-file support and a clear model for external collaboration.
For more detail on the related MX workflow, see file-exchange controls. Government workflows may involve contractors, suppliers and inter-agency teams, so file controls often need to remain understandable across organizational boundaries.
The CISA cloud security architecture guidance provides a useful external reference for secure cloud applications, visibility and operational controls. The sender retains a clearer connection between the file, the intended recipient and the access window applied to that exchange.
My MX Data can restrict an exchange to named or authorized recipients rather than relying on an unrestricted public link. Different transactions can carry different conditions, so routine material does not need to be handled exactly like highly sensitive information. Government workflows may involve contractors, suppliers and inter-agency teams, so file controls often need to remain understandable across organizational boundaries.
Recipient selection, permissions, multi-factor authentication and expiry settings can then be combined to shape who can reach the information and for how long. Administrative oversight matters because access can change during a project as people join, leave or move between responsibilities.
The CISA cloud security architecture guidance provides a useful external reference for secure cloud applications, visibility and operational controls.
MX records activity associated with file exchanges, giving relevant senders and administrators a clearer history after information has been shared. Government workflows may involve contractors, suppliers and inter-agency teams, so file controls often need to remain understandable across organizational boundaries.
Records may include uploads, access, downloads, comments, recipient activity, timestamps, transaction history and relevant user or IP details. Notifications can also draw attention to pending downloads, new comments or expiring access without requiring somebody to check each exchange manually.
For more detail on the related MX workflow, see MX feature set. A transaction record is most useful when it answers practical questions such as who accessed the file, when they did it and whether the current version was downloaded.
The CISA cloud security architecture guidance provides a useful external reference for secure cloud applications, visibility and operational controls. That gives the team a more defensible record of the handoff.
Yes. MX supports expiry settings and configurable access conditions, helping teams avoid leaving sensitive files available indefinitely after the business purpose has passed. Government workflows may involve contractors, suppliers and inter-agency teams, so file controls often need to remain understandable across organizational boundaries.
Recipient permissions and download conditions can add further control where the relevant workflow supports them. For more detail on the related MX workflow, see file-exchange controls. That gives the team a more defensible record of the handoff.
The CISA cloud security architecture guidance provides a useful external reference for secure cloud applications, visibility and operational controls.
MX can support data-location and storage-region requirements, subject to the selected service, configuration and contractual arrangement. Government workflows may involve contractors, suppliers and inter-agency teams, so file controls often need to remain understandable across organizational boundaries.
That can matter where organizations need to consider jurisdiction, customer contracts, internal policy, cross-border transfers or sector-specific restrictions. For more detail on the related MX workflow, see MX security and administration features.
The CISA cloud security architecture guidance provides a useful external reference for secure cloud applications, visibility and operational controls. The acceptable region should be decided by the organization after considering its legal, contractual and risk requirements rather than assumed from a generic platform setting.
MX can support government and public-sector file exchanges with controls designed around recipient identity, access conditions and a traceable exchange history.
That is useful where agencies, contractors, suppliers and project partners need to handle sensitive project information, technical data and large document sets without losing sight of who received the information and what happened next. For more detail on the related MX workflow, see secure large-file sharing.
The CISA cloud security architecture guidance provides a useful external reference for secure cloud applications, visibility and operational controls. A transaction record is most useful when it answers practical questions such as who accessed the file, when they did it and whether the current version was downloaded.
Protection in MX relies on several controls working together rather than a single security feature. Government workflows may involve contractors, suppliers and inter-agency teams, so file controls often need to remain understandable across organizational boundaries.
AES-256 encryption forms part of the model alongside named-recipient access, permissions, multi-factor authentication, expiry controls and detailed activity records. The sender retains a clearer connection between the file, the intended recipient and the access window applied to that exchange.
For more detail on the related MX workflow, see file-exchange controls. Layered controls are useful because identity, confidentiality and evidence solve different parts of the file-exchange problem.
The CISA cloud security architecture guidance provides a useful external reference for secure cloud applications, visibility and operational controls. Different transactions can carry different conditions, so routine material does not need to be handled exactly like highly sensitive information.
Yes. MX is designed for exchanges involving more than one organization, including agencies, contractors, suppliers and project partners.
Named-recipient controls, recipient groups, linked transactions and audit history can help keep a complex external workflow more consistent as information moves across company boundaries. For more detail on the related MX workflow, see secure external exchange.
The CISA cloud security architecture guidance provides a useful external reference for secure cloud applications, visibility and operational controls. Government workflows may involve contractors, suppliers and inter-agency teams, so file controls often need to remain understandable across organizational boundaries.
