How do I share a client file safely and remove access later?

Business Tech & Tools

How do I share a client file safely and remove access later?

The short answer

Share the smallest useful folder with a named person, give the lowest permission that lets her do the job, and set an expiration date when your service supports it. Before sending the link, open it in a private browser window to see what an outsider sees. When the work ends, remove access from the folder, check inherited permissions and public links, and record that the review is complete.

Avoid “anyone with the link” for private client work. A convenient link can be forwarded, pasted into the wrong message, or left in an old project note long after you have forgotten it.

Decide what the person needs to do

Use viewer when someone only needs to read or download. Use commenter when she should give feedback without changing the source. Use editor only when she must alter the working file.

If the folder contains five documents and the client needs one, share one. If a contractor needs working images but not the agreement or invoice, create a contractor folder. This is easier to audit than a maze of exceptions inside a broadly shared folder.

Google Drive, for example, distinguishes viewer, commenter, editor, and owner permissions. It also warns that access granted to a parent folder can affect the items inside it. See Google's current sharing and permission guide. Other services use different names, so confirm what each role can download, reshare, or change.

Use this five-minute sending check

Before you send a client link:

  1. Confirm the recipient's email address from a trusted message or contract.
  2. Open the file and make sure it contains the intended client's information.
  3. Check the parent folder's members and general-access setting.
  4. Select viewer, commenter, or editor deliberately.
  5. Turn off resharing, copying, downloading, or printing when appropriate and supported.
  6. Add an expiration date for short-term access if your plan allows it.
  7. Open the link in a private browser where you are not signed in.
  8. Send the link in a new message that names the file and its purpose.

The private-window test catches two embarrassing mistakes: a client cannot open the file at all, or everyone on the internet can open it.

Understand what “remove access” cannot undo

Removing permission stops future access through your controlled account. It cannot pull back a copy that someone already downloaded, printed, photographed, pasted elsewhere, or received by email. Do not promise a client that revoking a link erases every copy.

Google's instructions explain how to remove a named person, set general access back to Restricted, and limit sharing or copying in supported files. They also note that such controls cannot stop every way a person might share the content. Use the provider's current stop or change sharing steps for the exact interface.

Close access as part of closing the project

Create an offboarding checklist with these lines:

  • final files delivered and opened successfully.
  • client access retained only where promised.
  • contractor and temporary collaborator access removed.
  • public or “anyone” links turned off.
  • shared groups checked for unexpected members.
  • local exports and temporary transfer copies cleaned up.
  • retention or deletion date recorded.
  • backup treatment confirmed.

Do the review while the project is fresh, not six months later when you no longer remember why an unfamiliar email address is present.

Treat sensitive files differently

Tax forms, identity documents, account credentials, health details, background checks, payment information, and children's information may require more than ordinary cloud sharing. Use an approved secure portal or another method suited to the data and your industry. Never ask a client to put passwords or full card details into a shared document.

The Federal Trade Commission recommends taking stock of personal information, keeping only what the business needs, protecting what remains, and disposing of it properly. Its guide for businesses is a useful starting point.

Privacy, retention, breach-notification, and professional rules vary. Check current requirements for your location, your client's location, and your field, and use a qualified professional when the information or consequences are serious.

Sources and further reading

A free next step

You don't have to build this alone

Bring your questions, share what you're working on, and meet other women building businesses from home. It is free to join.

Join Our Community Free

Related Questions

← All questions