This method seems fine for protecting data as far as I can tell.

I would definitely recommend using https though because only the hostname is sent in plain text, the URL should be fully encrypted in an https request.

On the other hand, I'm not sure how reasonable this method is from a liability perspective. If a client accidentally forwards a secure url to someone who causes them to lose money, then there might be a chance that you could be liable for not securing your product effectively.