Zipping a folder, setting a password and emailing it over is one of the oldest tricks in the book. It is free, it works offline, and for a moment it feels secure. But the second that ZIP leaves your outbox, you are flying blind. There is no way to see if it was opened, no way to take it back, and the password almost always travels in a follow-up message that is no more secure than the file itself. If you are looking for an alternative to password protected zip that keeps the simplicity but adds real control, 99 Data Rooms is a UK-hosted, flat-priced way to send a document, gate who opens it, know it was read, and revoke it if you change your mind. Try it free, see the whole journey in one place, then keep 99 and cancel the workarounds.
If your real question is broader than one method, our roundups of the best secure file sharing tools in the UK and the best ways to send a contract securely in the UK set out the alternatives side by side.
The short version
A password-protected ZIP is a method, not a product. It is you, a compression tool and an email. That is its charm and its ceiling. Once sent, it offers no tracking, no revocation, no audit trail and no e-signature. The password is a shared secret that is only as safe as the channel you send it on, and people routinely paste it into the same email thread as the file. If the recipient forwards the archive, you will never know. If you sent the wrong version, it is already out there.
99 Data Rooms keeps the "send a document" simplicity but wraps it in control. Gather your files into a room, gate access with a verified email and a one-time code instead of a shared password, share a tracked and revocable link, watch page-by-page who read what, watermark per viewer on the Business tier, and sign with a tamper-evident audit certificate. UK-hosted in London, flat GBP pricing.
Feature comparison
| Capability | Password-protected ZIP | 99 Data Rooms |
|---|---|---|
| Send a document you can take back | No; once sent it is gone | One-click revocation, even mid-view |
| Page-by-page analytics | None | Page-by-page viewer analytics, raw visit vs verified viewer |
| Access gate | A shared password, often sent insecurely | Verified email plus one-time code; NDA acceptance on Business |
| Per-viewer watermarking | None | Per-viewer watermarking on Business |
| Built-in e-signature with audit certificate | No | Yes, from Pro; certificate with signer IP, intent to sign, timestamps and SHA-256 fingerprint |
| Audit trail | None | Full record of access and versions |
| AI legal drafting | No | Yes; assembles vetted clauses, never invents |
| Encryption at rest | Strong (modern AES-256 archives) | AES-256 at rest, TLS 1.2+ in transit |
| Data residency | Wherever your email and recipient sit | UK-hosted in London, data resident in the UK |
| Pricing model | Free (your time and risk) | Flat GBP: free, Pro £19/mo, Business £49/mo, Enterprise £99.99/mo |
| Free tier | Effectively yes, but no controls | 3 rooms, 25 links, forever, no card |
What a password-protected ZIP does well
Let us be fair. A ZIP archive with a password has real virtues. It is free. It works entirely offline, so no service has to be up and no account is needed. It compresses several files into one tidy bundle. And modern archive tools use genuinely strong encryption, typically AES-256, so the file itself, sitting still, is not trivial to crack; the encryption at rest is not the weak point. For an internal handover of non-sensitive files between two people who already trust each other, it is quick and it does the job.
The trouble starts the moment the archive needs to travel to someone outside that circle, or the moment you need to prove what happened to it. Strong encryption on the file does nothing about the weak links: how the password gets shared, whether the recipient forwards the whole thing, and the total absence of any tracking, revocation, audit trail or signature. The gap is not the maths on the file; it is everything around it.
Where 99 Data Rooms wins
No shared-secret problem. Instead of a password that has to travel somewhere, 99 gates access with a verified email and a one-time code. The recipient proves who they are; you are not relying on a secret that can be forwarded, guessed or pasted into the wrong thread.
You can see what happened. A ZIP gives you silence. 99 gives you page-by-page analytics that separate a raw visit from a verified viewer, so you know the document was actually read and how far. That is the difference between hoping and knowing.
You can take it back. Sent the wrong version, or changed your mind about a recipient? One-click revocation cuts access, even mid-view. With a ZIP, once it is out, it is out.
The whole journey, not just the send. With a ZIP you still need separate tools to draft, to sign and to track. 99 runs the full journey in one place: draft with AI Legal Drafting (assembling vetted clauses from a maintained library, never inventing), gather into a room, gate, share, track, watermark per viewer on Business, swap files with version history, and sign with an audit certificate that records signer IP, intent to sign, timestamps and a SHA-256 fingerprint.
UK-hosted and honest about it. 99 is UK-built and UK-hosted in London, data resident in the UK, AES-256 at rest, TLS 1.2+ in transit, DPA on request, aligned with UK GDPR and the Data Protection Act 2018. On certifications we are clear: SOC 2 and ISO are held by our infrastructure providers Supabase and Cloudflare, and we run on their audited platforms rather than claiming those badges ourselves.
Consolidation on a flat bill. A ZIP is free but incomplete, so you end up buying separate tracking and signing tools anyway. 99 replaces that stack for a flat GBP price with no per-seat surcharge.
On e-signatures: they are admissible for most commercial documents in England and Wales, with exceptions including deeds, wills, land transfers and lasting powers of attorney (see Sources below). That is general information, not legal advice.
99 is in beta and improving fast, so the journey you use today keeps getting sharper.
How to try it and what to compare
Use the free tier to run a fair test: 3 rooms, 25 links, forever, no card.
1. Take the files you would normally ZIP and password, and drop them into a 99 room instead. 2. Share with a verified-email gate rather than a shared password. Notice you never have to send a secret separately. 3. Open the link from another address and watch it register as a verified viewer, page by page. 4. Revoke the link and confirm access disappears immediately. 5. On Pro or above, run a document through e-signature and inspect the audit certificate.
Compare on the questions a ZIP cannot answer: was it opened, by whom, how far did they read, can I take it back, and is there a record I could stand behind later. The one thing a ZIP does well, encrypting the file at rest, 99 also does, so you are not trading that away.
Try 99 free, then consolidate
Keep the simplicity of "send a document" but add the control a ZIP never had. See the whole journey (draft, gate, share, track, sign, revoke) in one place. Start free: 3 rooms, 25 links, forever, no card. Once you have seen it work end to end, keep 99 and drop the workarounds.
The bottom line for UK teams
A password-protected ZIP is genuinely useful for one thing: encrypting a file at rest so that, if the archive is intercepted, the contents are hard to read. That part is real, and 99 does it too. What a ZIP cannot do is give you any control or visibility once the recipient has the password. You cannot see whether they opened it, you cannot stop them forwarding it, and there is no audit trail if anyone asks later who saw what. For anything you would mind leaking, that gap matters. Try 99 Data Rooms free and send the same document as a gated, tracked, revocable link instead, and keep the ZIP for the rare offline case where a link genuinely will not do.
Sources
- ZIP archive encryption uses AES (up to 256-bit) in the widely used format specification, which is strong for data at rest: PKWARE APPNOTE (ZIP file format and encryption), https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT
- Electronic signatures, admissibility and execution of deeds in England and Wales: Law Commission, Electronic execution of documents (2019), https://lawcom.gov.uk/project/electronic-execution-of-documents/ ; HM Land Registry Practice Guide 82, https://www.gov.uk/government/publications/electronic-signatures-accepted-by-hm-land-registry-pg82
Is a password-protected ZIP actually insecure?
The encryption on the file can be strong, typically AES-256, so the archive sitting still is hard to crack. The weakness is everything around it: the password usually travels insecurely, there is no verified gate, no tracking, no revocation and no audit trail. Security is a chain, and the ZIP only protects one link.
Is 99 more expensive than zipping a file myself?
Zipping is free in cash but not in risk or effort, and it does not include tracking or signing. 99 is flat GBP: a free tier, then Pro £19/mo, Business £49/mo and Enterprise £99.99/mo, with no per-seat surcharge. For anything you need to control, that is usually cheaper than the tools you would otherwise bolt on.
Where is my data stored with 99?
In the UK. UK-hosted in London, UK data residency, AES-256 at rest, TLS 1.2+ in transit, aligned with UK GDPR and the Data Protection Act 2018. A DPA is available on request.
Can I stop someone opening a file after I have sent it?
Yes. One-click revocation cuts access even mid-view. A password-protected ZIP offers nothing here once it has left your outbox.
Do I still need a separate e-signature tool?
No. From the Pro tier, 99 includes e-signature with a tamper-evident audit certificate, so the sign step lives in the same place as the send.
Is 99 a finished product?
It is in beta and improving fast. The core journey from drafting to signature is live and usable now.
Comparison details are checked against public vendor pages at the date shown in the article and may have changed since. Names and trademarks belong to their owners.