Secure file sharing for business: start with access, not encryption

Why encryption is the wrong place to start

Encryption protects information from being read if someone intercepts traffic or gains access to stored data. It doesn't stop an authorised account from being compromised, or an employee from forwarding a link to the wrong person.

That's why I'd start with access, not a TLS badge. Verizon's 2025 Data Breach Investigations Report analysed more than 22,000 security incidents and 12,195 confirmed breaches. Third-party involvement in breaches doubled to 30%, and credential abuse was one of the leading ways in, at 22%.

A proposal link or contract link is a third-party boundary. The moment you share it, you've extended access beyond your own team, often to someone whose identity, device and forwarding habits you don't control. A link that works for anyone who receives it isn't protected just because the connection uses encryption.

The controls that matter are the ones that limit what happens after sharing: verify recipients, require authentication, set an expiry, restrict downloads when possible, and revoke access when circumstances change. Add MFA to protect the accounts that create and manage shared documents. These measures won't replace encryption. They address the risks encryption doesn't.

My starting point: Treat every recipient, vendor and connected service as part of the security boundary. A link isn't a security policy.

That's the useful way to think about secure file sharing for business. Start with identity and access, then layer in protection for the content and records of what happened.

The layers I check, in order

A secure workflow needs more than one lock. I'd check the following layers in order, because a gap in one can undermine the others.

Protect the file in transit and at rest. Confirm the service encrypts information as it moves between devices and its infrastructure, and while it's stored. CISA's cloud storage guidance recommends the same, alongside MFA and restricted access. This is the foundation, not the whole answer.

Verify identity. Use MFA for users who manage or access sensitive material, and SSO where it fits your identity setup. Email verification can help identify a recipient, but it shouldn't be treated as a replacement for proper authentication.

Give people only the access they need. A client reviewing a proposal may need view access, not edit rights or an unrestricted download. A contractor working on one report doesn't need access to the whole client folder. Keep permissions specific to the document and the job.

Control the link's lifecycle. Set an expiry date on proposal links. Revoke a contract link when the vendor relationship ends. Restrict downloads where a browser view is enough. That won't stop someone photographing a screen, but it removes the easy copy.

Record activity and respond. Keep access logs and alerts available to the people responsible for the documents. A control that can't be monitored or acted on is easy to overlook.

For the storage side of the same problem, see my guide to document storage security.

What HIPAA, GDPR, ISO 27001 and SOC 2 actually require

Compliance isn't a sticker you add to a sharing link. It depends on the data, where it's handled, the organisation's processes and what customers or regulators require.

For UK businesses, the ICO says encryption is an example of an appropriate technical measure under UK GDPR, not a blanket requirement for every file. The right measure depends on the risk of the processing. The ICO's encryption guidance also makes clear that encryption doesn't remove data-protection responsibilities when the organisation can access the decryption key.

ISO 27001 is a management-system standard. It sets requirements for identifying and managing information-security risks, then reviewing and improving controls. It doesn't certify that a particular sharing link or product feature is secure. When a provider makes an ISO claim, ask which entity and services are covered, whether the certificate is current, and whether the relevant hosting and support activities fall within its scope. LiveDocument's security page lists what it holds and covers.

HIPAA matters to US organisations handling protected health information on behalf of covered entities or in other relevant roles. Its safeguards are administrative, physical and technical, so file encryption alone doesn't answer whether the wider workflow is suitable. Where a business associate relationship requires it, confirm that the necessary agreement and operational safeguards are in place.

SOC 2 is an attestation against trust services criteria. It isn't a feature list or a universal guarantee that a product suits your use case. Ask for the relevant report, check its scope, and understand which services and controls it covers.

Compliance claims are a reason to ask better questions, not a reason to stop asking them.

Decide which rules dominate by looking at the data, jurisdictions and customer contracts involved. A vendor's assurances can support your assessment, but one tool rarely settles every part of your compliance picture.

The behavioural risks most guides skip

The day-to-day failure is usually not a villain plotting to steal files. It's someone rushing to send a document and choosing the wrong recipient, leaving a link open, or putting confidential material into an unapproved tool.

A 2025 survey of IT and cybersecurity professionals found that 77% of organisations had an insider-related data loss incident in the previous 18 months, and nearly half of those incidents (49%) came down to simple negligence such as misdirected emails and insecure file sharing, according to Fortinet's write-up of the survey.

That matches the workflow mistakes I'd design around:

• Misdirected links: someone picks the wrong contact from autocomplete and shares a pricing proposal.
• Accidental forwarding: a recipient passes a link on, and the sender has no way to limit access to the intended person.
• Oversharing: an employee grants edit access or exposes a whole folder when the recipient only needs to read one file.
• Unapproved AI and cloud tools: an employee pastes confidential text into a service the organisation hasn't approved.
• Links that outlive the relationship: the deal ends, but the external link remains active.

Make the safe choice the easy choice. Use a recipient check before sending, default to expiring access, show a clear warning before downloads or broad permissions, and require approval for named recipients on particularly sensitive material. When someone makes a mistake, use it as a short training moment tied to the actual workflow, not as a reason to circulate another long policy document.

A platform can be technically well protected and still be unsafe in practice if users can't tell who will receive a link or how to restrict it. Usability is part of the control.

Four document types, the same controls

The risk changes with the document, but the principle stays the same: limit the audience, make access temporary where possible, and know what happened.

A B2B sales proposal usually goes to people outside your organisation. Require an email address or authenticated access, set an expiry, and avoid unrestricted downloads if a browser view is enough. A realistic failure is a proposal forwarded to a wider buying group than intended, leaving sensitive pricing exposed. If the details in a commercial proposal matter, control the link rather than assuming the first recipient will keep it private.

A legal contract needs named recipients and a clear route to revoke access. A generic link shared through a long email chain makes it harder to know who had the document. If a supplier relationship changes, revoke their access rather than hoping they've deleted the file.

A consulting report often passes through a team before it reaches the client. Keep versions clear and use logs to distinguish who viewed or downloaded the current document. One plausible failure is a colleague sharing an outdated report containing figures that were later corrected. Version discipline and an activity record help identify what went where.

An investor deck can contain commercially sensitive information. Share a controlled version and remove or anonymise details that aren't needed. If a deck is sent widely without access controls, the founder may have no reliable way to establish who saw it or whether it was passed on.

LiveDocument combines a document and optional video walkthrough in a tracked browser link, with email gating, page-level activity and alerts. It handles PDFs and images, and you can expire or revoke a link at any time. For sales, legal and consulting teams, those features can help explain a document and see how recipients engage with it, but they don't replace identity management, storage controls or a sound sharing policy.

Audit trails, alerts and the limits of page analytics

A log that only says a file was shared isn't enough for an investigation. You need to know which identity or session viewed it, when access happened, whether the file was downloaded, and whether permissions or links changed. Include successful and failed login attempts, link creation and revocation, and permission changes.

Restrict access to the logs, protect them against tampering and retain them according to the obligations that apply to the material.

Page-level analytics answer a different question: which parts of a proposal or report did a recipient view? That can help a sales or client-services team prepare for a follow-up. It isn't a substitute for a security record, and viewing time alone doesn't prove that someone understood or agreed with the content.

Here's a practical example. A proposal link gets opened from an unexpected country in the middle of the night. An alert prompts the owner to check the event, revoke the link if the access looks suspicious, and contact the client. The log should preserve the timeline and the relevant account or session details so the team can establish what was accessed.

Keep logs for as long as your contractual or regulatory obligations require, and no longer. Don't let your default settings decide the retention period.

Tracking is personal data too. Tell recipients their activity is recorded, limit who on your side can see the analytics, and don't keep viewer records longer than the deal needs them. Check your own client agreements before you start. LiveDocument's PDF tracking shows page-level activity, which is useful alongside, not instead of, a proper security audit trail.

A buying checklist you can use this week

A vendor demo should answer operational questions, not just show a lock icon. Ask how the product handles each control, and request evidence for claims that affect your obligations.

ISO/IEC 27001 specifies requirements for an information security management system. It's a framework for managing controls, not a certificate that an individual product feature is secure.

LiveDocument provides encryption in transit and at rest, page-level analytics, alerts and email gating, and publishes its position on HIPAA and GDPR. It's designed for sharing documents with context and visibility, and can sit alongside the wider storage and identity systems your organisation uses.

Put ease of use on the checklist. The safest workflow is the one your team can follow without creating workarounds.

Frequently asked questions