Seven days¶

Before the move, anything too large for email left the Home through Sendstone: drag the files in, type an address, send, and the recipient gets a link that works for seven days, after which the service says it deletes the files. No account, so no record, so no inventory. What is known came from email trails and one conversation in which the programmes coordinator asked the IT coordinator whether there was an approved alternative, because Sendstone “sometimes blocks things and it is a bit annoying”. The known transfers start with a Bestiary export with full medical histories for seven residents, sent to an external veterinary specialist with no data processing agreement. A contact list for 340 volunteers went to the event coordinator for the fundraising dinner, three grant applications with budgets went to funders in Germany and the Netherlands, and a folder of therapy photographs went to a journalist. The scraps for this layer say: a file transfer is a copy the Home hands to somebody else’s building, and “deleted after seven days” is a sentence about the sender’s building only.

Seven days, read¶

Sendstone is a habit more than a company, and the habit has a real-world shape. The best-known service of the kind was founded in the Netherlands and belongs since July 2024 to Bending Spoons, Bending Spoons Operations S.p.A. of Milan, which lists it among its acquisitions with the note that it “recovered 3+ million expired transfers with new feature”. That one line settled the question the Sendstone page leaves open about what happens to files after the link expires: it depends on who owns the service this year, and expired is a state a new owner can undo. A transfer service’s terms are the sender’s contract with nobody, and a seven-day promise is only as long as the ownership.

What went through it¶

The inventory that Sendstone could not provide was made from the other end, by asking. The Bestiary export was the item of most concern and the one that produced a decision: the specialist got a data processing agreement, drafted after the programmes team raised the case with the DPO, and the Home’s clinical exports now go under one or not at all. The volunteer list, the grants and the photographs were each traced to a recipient, and each had a good reason. Nobody at the Home sent anything wrong. They sent it by a road nobody had looked at.

Sending, from the shelf¶

The replacement was already paid for. The file store makes a share link for any file or folder, and its sharing settings force a password and an expiry date on all of them, so a link to a funder is a link to the Home’s own Nextcloud, at Hetzner in Falkenstein, that stops working on a day the sender chose and cannot be pushed past. The file never leaves the Home’s building until the recipient downloads it, the download is logged, and the link is unshared with one click when the review is done. That is what Sendstone did, on the Home’s shelf, under the Home’s contract.

For the staff member on a train with a photograph to send, Tresorit Send went into the notes as the pocket option: free, up to five gigabytes, end-to-end encrypted, from Tresorit, which is part of Swiss Post, with offices in Switzerland, Germany and Hungary. It is still somebody else’s building, and a better one, and it is for photographs of a phoenix, not for medical histories.

Receiving¶

The harder half was files coming in: a specialist’s report, a funder’s signed agreement, a journalist’s proofs. The files page had switched public uploads off, because a folder anyone can upload to is an invitation. Nextcloud’s file drop is the narrow version, a link through which the outsider can only upload, without seeing what is already in the folder, with a password and an expiry date like any other link. So the setting is on for one group, the DPO’s, and a file drop is made for a purpose and unshared after it. A specialist sends a report into a folder that shows the specialist nothing, and the folder is the Home’s.

The other end¶

None of this reaches the recipient’s copy. The specialist who received seven residents’ histories still has them, if the specialist kept them, and the Sendstone page says whether the files were even downloaded before the link expired is not known. What the Home can do about the other end is a contract and a habit: a DPA before a clinical export, a named recipient per link, and the question “does this person need the whole file” asked before the question of how to send it. The IT coordinator’s email telling staff not to use Sendstone was read by an unknown proportion of them. The share link that is quicker than Sendstone was read by all of them, because it was quicker.

The parcel office¶

   sending: Nextcloud share link ── password, expiry, logged, unshared after
              │
   the Home's own shelf, Falkenstein ── the file landlord, no new one
              │
   receiving: file drop ── upload only, DPO's group, one purpose, then closed

   in a pocket: Tresorit Send, Swiss Post ── photographs, not histories

   at the other end: a DPA, or no clinical export

No service whose seven days belong to whoever buys it next.

What could go wrong?

• The file landlord is unreachable, and a funder’s deadline lands on the day, so the pocket option carries the grant application, no personal data in it, and the histories wait.

• A staff member reaches for Sendstone out of habit, as three did after the email, and the asset register’s discovery conversation is the only thing that hears about it.

• A file drop is made and never closed, and becomes the folder anyone can upload to that the setting was off to prevent.

• The recipient keeps the file, which no setting on the Home’s side has ever prevented.

The file store is gone, what now? The same as on the files page, with one addition: all the links the Home ever sent stop working at once, which for a transfer service is the behaviour the Home wanted and never got, and the pocket option carries what has to move today.

Nanny Ogg sends anything that matters by Greebo, on the grounds that nobody has ever successfully taken anything off Greebo.