Skip to content
Home Features Actions
SendSafely Actions

Automate encrypted workflows without ever breaking encryption.

A point-and-click workflow editor that chains AV scanning, DLP, archival, and custom API calls onto every encrypted upload. Native Actions run inside SendSafely on file metadata. External Actions deploy into your own AWS so decrypted content never leaves your environment.

No-code
Build automated workflows without writing code — or extend them with your own.
Native + External
Two action types
Your AWS
External actions deploy in-account
Webhook-driven
Trigger any API on every event
The Actions framework

One framework, three building blocks.

Workflows chain Actions onto events. Native Actions handle metadata operations inside SendSafely. External Actions run wherever you choose — typically your own cloud — and can decrypt content. The Workflow Editor lets your operators wire them together without code.

Native action

Built-in, metadata-only

Pre-built Actions that run inside SendSafely. They operate on file metadata only and cannot access the content of encrypted files. Block a package until a scan passes, hold a file until it's archived, or delete on quarantine.

Runs inSendSafely
Sees contentNo — metadata only
SetupToggle on
External action

Deployed in your AWS

Triggered by webhook, runs in your own cloud environment. Because the Action lives in your perimeter, it can decrypt files and run AV, DLP, or archive logic against content — without that content ever leaving your environment.

Runs inYour AWS account
Sees contentYes — via your key
SetupCloudFormation template
Workflow editor

Point-and-click composer

Pick a trigger event, drop Actions onto it, add filters between steps. Branch on the result of an earlier Action ("only delete if AV returned quarantined"). Toggle live when ready. Logs and replay built in.

WhereSendSafely portal
Skill neededNo code
BranchesOn any prior result

The Workflow Editor for operators, not developers.

Built so a security analyst, support manager, or compliance lead can wire a multi-step workflow without filing a ticket with engineering.

app.sendsafely.com/workflows
SendSafely Workflow Editor showing a multi-step workflow
Live screenshot from the SendSafely web portal

Pre-built Actions, ready to deploy.

Templates ship as AWS CloudFormation stacks. Deploy as-is or fork them as a starting point for your own Actions. The list grows over time — talk to your account team for the current catalog.

Request a template
AV Scanning
External Actions that decrypt files in your AWS, scan, and trigger a Native delete on hit.
3 templates · runs in your AWS
CrowdStrike

Scans decrypted contents via the CrowdStrike Falcon API. Quarantined packages can be auto-deleted.

Live
OPSWAT

Multi-engine scan via the OPSWAT MetaDefender API. Configurable thresholds per file type.

Live
Sophos

Uses the SophosLabs Intelix API to flag malicious payloads before delivery to a recipient.

Live
DLP Scanning
Block PII, PHI, or regulated data before it reaches a recipient.
1 template · more shipping
Google Cloud DLP

Sends decrypted contents to the GCP Sensitive Data Protection API. Violating packages can be blocked and stakeholders alerted.

Live
More DLP vendors

Microsoft Purview and Nightfall on the roadmap. Have a vendor you'd like to see? Tell your account rep.

Roadmap
Compliance Archiving
Capture every encrypted package to long-term, tamper-proof storage.
1 template
S3 Export

Exports decrypted package contents to a private S3 bucket — commonly a WORM bucket for tamper-proof long-term retention.

Live
Azure Blob & GCS

Equivalent archive templates for Azure Blob Storage and Google Cloud Storage are on the roadmap.

Roadmap
Native (metadata-only)
Built-in Actions that run inside SendSafely. They never see plaintext.
3 actions · built-in
Block / Unblock

Hold downloads until a downstream Action signals clear — e.g., block until AV passes.

Built-in
Hold / Release

Keep an encrypted package on the server until an archive Action confirms long-term storage.

Built-in
Delete file / package

Auto-delete when an upstream Action flags content — quarantine on AV hit, purge on DLP violation.

Built-in

Custom Actions. Any HTTPS endpoint can be an Action. Bring your own AV, DLP, archive system, ticketing tool, or notification channel — the Workflow Editor speaks plain webhooks. If you can describe the call in JSON, you can wire it into a workflow without writing SendSafely-specific code.

How a workflow runs

Trigger. Filter. Act.

A workflow is a cascading waterfall: an event in SendSafely fires, optional filters narrow it down, then Actions run in sequence. Each Action can branch on the result of the previous one.

Step 01

Pick a trigger event.

A Secure Package finalized or a file uploaded to a Workspace. Add event filters to narrow by sender, recipient domain, file type, or package owner.

Step 02

Drop Actions onto it.

Choose a Native Action from a dropdown, or call an External webhook. Add per-Action filters so a step only runs when the previous one returns the result you care about.

Step 03

Toggle live, watch the logs.

Workflows run on every matching event. Execution logs are visible from the workflow list. Failures can be replayed once you've fixed whatever was wrong upstream.

New in 2026 — Personal Workflows

Automation for the person who does the work.

Personal Workflows let non-admin users wire up automations against their own SendSafely activity — without filing a ticket and without impacting anyone else's data.

  • Scoped to the user: a non-editable Package Owner filter locks the workflow to that person's own items.
  • Same editor as Enterprise workflows — same Native + External Actions, same filters.
  • Admin-gated: turn it on per Security Group, audit + impersonate from the Enterprise console.
See a personal workflow demo
A user's Personal Workflows listing inside SendSafely
Where teams use Actions

A few of the patterns customers build.

Quarantine on AV hit

External AV Action scans decrypted contents in your AWS. Native Delete Action fires if results return malicious. The owner is notified, the package is gone, no human review needed.

Auto-archive to WORM

Every finalized package routes through the S3 Export Action into a tamper-proof bucket. Native Hold ensures originals stay put until the archive confirms write.

Block PII at the door

Google DLP Action inspects decrypted contents in your environment. Native Block Action keeps the package undeliverable until a compliance reviewer signs off.

Open a ticket on every drop

Custom webhook Action pings your ticketing system whenever a Dropzone receives an upload — populating Jira, Zendesk, ServiceNow with the package metadata.

Route by sender domain

Event filter on the sender domain routes vendor uploads to one workflow, partner uploads to another. Both run their own AV + archive chains.

Personal forwarders for service accounts

A service-account user runs a Personal Workflow that forwards every Dropzone upload to a parsing pipeline. No global admin involvement, no shared keys.

The encryption boundary

Actions never weaken the trust model.

Native Actions never see plaintext — they operate on metadata only. External Actions can decrypt content, but they only do so inside your own perimeter, using a Trusted Browser Key (per-user) or Portal Master Key (portal-wide) that you provision.

Independent SOC 2 Type 2, HIPAA, PCI DSS, and GDPR audits cover the SendSafely platform that Actions run on top of.

Compliance & certifications
SOC 2 Type 2 HIPAA PCI DSS GDPR CCPA
Client-side OpenPGP
Files are encrypted on the device before they ever leave it.
Split-key architecture
The decryption key is split so no single party—including SendSafely—can decrypt file contents on its own.
Full audit trail
Every send, recipient open, identity check, and download is logged with timestamps for compliance reporting.
Talk to us

Stop building one-off scripts for every upload.

See SendSafely Actions running against the workflow you already have. We'll walk through Native + External together and show you what's in the library today.