It would not take much extra effort to include the encryption on my side, since I am already using PAR to bundle all the required modules.

Niel

I unfortunately have no guarantees that a customer has GPG.

I would list that as a requirement for reliable encrypted transmission of data, rather than roll my own. I mean, if they don't have mail encryption, they need it anyways. At least for any account which sends sensitive information to the extranet.

--shmem

_($_=" "x(1<<5)."?\n".q·/)Oo.  G°\        /
                              /\_¯/(q    /
----------------------------  \__(m.====·.(_("always off the crowd"))."·
");sub _{s./.($e="'Itrs `mnsgdq Gdbj O`qkdq")=~y/"-y/#-z/;$e.e && print}

I'm still in two minds over this. Many corporate customers have limits on mail sizes and content. (e.g. Mail Marshal).

Your suggestion is worth considering though, one possibility would be to force the customer to transmit the data using SCP, which I personally feel is a perfectly legitimate solution. To be honest, I think it's the cool "we'll encrypt it for you" aspect that draws me to looking into this.

Niel