If a sponsor owns the TMF then it is appropriate that they also manage all the access. It should not matter if vendors and CROs file into the TMF as the expectation for filing is that it is related to the study and tells the story. I don’t quite follow the concern for CRA’s email as confidential information as this info is already part of a study contact list which is a core document in the TMF irrespective of who is uploading or access. If you can elaborate more on the concerns maybe others can chime in as well.