The timer is the easy part

A prototype can store a timestamp and send an email when it becomes old. A dependable conditional delivery must also handle account takeover, missed jobs, duplicate execution, owner warnings, recipient verification, expired links, retries, audit history, encryption, key recovery and safe deletion.

The key question is not whether a developer can write the first version. It is whether someone will operate, test and fund the system for years while ensuring a false trigger does not expose sensitive material.

Minimum DIY architecture

A serious design needs authenticated check-ins with anti-CSRF and replay protection; a durable state machine; idempotent scheduled processing; a transactional email provider; bounce and complaint handling; one-time recipient tokens; link expiry; rate limiting; logs; backup; monitoring; and a recovery plan for the service itself.

Use modern authenticated encryption and define key custody before storing real content. A cloud KMS can protect server-held keys but is not the same as user-held self-custody. A browser-derived key reduces provider recovery capability but creates a lost-key problem.

Failure tests to run before relying on it

Simulate an owner who checks in during the safety period, a duplicated scheduler invocation, an email provider timeout, a bounced recipient, a scanner opening the link, an expired token, a lost Private key, a rotated domain, a database restore and a partial release.

Verify that each transition is atomic and repeatable. Test the recipient journey on another device and preserve the expected file hash so you can confirm the recovered file matches the original.

When build or buy makes sense

Build when the system is part of a maintained security programme, the team owns the threat model, and long-term operation is funded. Buy when the need is conventional, the service's recovery model fits, and independent copies remain available.

Neither choice removes trust. A hosted service adds provider, domain and billing dependencies. A DIY system adds maintainer, cloud-account and code-quality dependencies. Document who watches the watcher in either design.