Last updated:

Boomerang for large files

Website
bmrng.me
Vendor
Boomerang Works BV
I use it for
Handing mailbox data to a lawyer, with the PIN sent separately by text message.

A mailbox export of several gigabytes cannot be emailed as an attachment. At a law firm an attachment that is too large simply bounces, with a message that it is too big. A USB stick by post, on the other hand, takes days. If the recipient and the client agree to an online transfer, I use Boomerang.

Boomerang is for handing data to a single recipient. If all parties need to be able to view documents without downloading them, with a log of who opened what, I use Tresorit.

Why Boomerang

I am not saying Boomerang is the best in every case. It is what I use, and this is why.

WeTransfer has become too commercial. After the takeover by Bending Spoons there was an uproar in 2025 over terms of service that gave the company a licence on uploaded files (Silicon Canals). Boomerang was only just founded by one of the founders of WeTransfer (TechCrunch). Tresorit Send would have worked too, but to me it seems a bit too heavy a tool for what we need here. And with a OneDrive link you are stuck with a link tied to specific email addresses, which is exactly what I want to avoid for this use.

What it gives me:

  • The data stays in Europe, and that matters. It is also encrypted, in transit and at rest. That is stated in their product information. Refer to that source in the report.
  • The download page asks for a PIN. The link alone does not get anyone in, so link and PIN can travel over two channels: see two-channel transfer.
  • The link expires by itself, on a fixed date.
  • The recipient downloads in the browser and does not have to install anything.

For the PIN you need the paid version anyway. If you only need to share something once for a case, take that subscription for one month and cancel it afterwards. Then you are covered. It costs about €7 a month. Check the current price on bmrng.me, because it changes.

Procedure

  1. Ask the recipient and whoever gave the assignment for written agreement. What belongs in the folder is covered under Purview.
  2. Upload a single ZIP, without compression, with the manifest inside. Put the hash of the ZIP in the report.
  3. Test the download yourself, with the PIN.
  4. Email the link and send the PIN by text message, to the mobile number the recipient supplied for that purpose. State until when the link works. I call it “a form of two-factor authentication”: every lawyer understands that straight away.
  5. Ask for confirmation that the download succeeded.
  6. When you send the report, remind the recipient of the expiry date.

What Boomerang does not do

Boomerang does not prove that the content arrived unchanged. That is what the hash values in the signed report are for, see Integrity.

You delete your own copies only when whoever gave the assignment expressly agrees to it.

In the report

  • that the transfer took place online, with whose agreement and when;
  • which service, where the data was stored and until when, with the source;
  • how link and PIN were sent, and to whom;
  • the hash of the ZIP;
  • that you tested the download beforehand.