Collaboration & workplace
Secure file sharing for businesses: links, expiry and access control
How companies share files with customers, suppliers and auditors securely: expiring links, revocation, access by role, sensitive data and audit trails.
Every day, companies send files outside: proposals to customers, contracts to suppliers, payroll data to auditors, reports to banks. Most of it goes as email attachments or through consumer file-sharing apps, which means copies live forever in other people's inboxes and nobody knows who has access. Secure file sharing keeps control with the company: who can open a file, until when, and the ability to take access back.
Risks of uncontrolled sharing
- Files forwarded beyond the intended recipient
- Outdated versions circulating after changes
- Former employees retaining files in personal accounts
- Sensitive personal data sent without protection
- No record of what was shared, with whom
Sharing options compared
| Method | Control | Risk |
|---|---|---|
| Email attachment | None after sending | High: permanent copies, forwarding |
| Consumer file-sharing with personal accounts | Depends on the employee | High: company loses control when employee leaves |
| Company workspace link with expiry | Expiry date, revocation, company-owned | Lower |
| Company workspace link with expiry and restricted access | Plus limited audience | Lowest for most needs |
Good practices
- Share links, not attachments, from a company-owned workspace.
- Set expiry dates suitable for the purpose (for example, two weeks for a proposal review).
- Revoke access when a project ends or a relationship changes.
- Share the minimum: a single file or folder, not a whole drive.
- Mark confidential files and limit who can create external links for them.
- Keep a record of external shares by file and recipient.
Sensitive data rules
Some files need extra care:
| Data type | Examples | Practice |
|---|---|---|
| Personal data of employees | Payroll registers, 201 files | Share only with authorized parties under agreements; minimize fields |
| Customer personal data | Customer lists, contact data | Share only for a legitimate purpose; avoid unnecessary fields |
| Health information | Medical results, clinic data | Treat as sensitive personal information |
| Financial and legal | Contracts, bank details, board papers | Restrict to named recipients; shorter expiry |
The Data Privacy Act requires appropriate security for personal data, including when shared with third parties such as payroll providers or auditors. Use data sharing or outsourcing agreements where required. See the Data Privacy Act and business systems.
Internal sharing
Inside the company, share through team and company workspaces with role-based access rather than copies sent by chat. When people change roles or leave, their access changes with them (offboarding).
Policies to put in writing
- Approved tools for internal and external sharing
- Who may share which types of files externally
- Default and maximum expiry periods
- Rules for sensitive personal data
- What to do if a file is shared by mistake
Where Cirquolus fits
Cirquolus Vault & workspaces offers personal, team and company file storage with public sharing using expiry dates and access revocation, alongside project boards and built-in editors. Related: document management.
Frequently asked questions
What is the safest way to share files with external parties?
Share links from a company-owned workspace with limited scope, an expiry date and the ability to revoke access.
Why are email attachments risky?
Once sent, attachments cannot be recalled or controlled and may be forwarded or kept indefinitely.
Can access to a shared link be removed?
Yes, if the platform supports revocation. Revoke access when the purpose ends.
What should be done if a file is shared with the wrong person?
Revoke access immediately, assess what data was exposed, and follow your incident response process, including Data Privacy Act obligations if personal data was involved.
Bring this workflow to a Cirquolus demo.
Show us your current process, companies and branches. We will map it to the modules you need and propose a realistic rollout.