How Do You Do Secure Document Sharing With People Outside Your Team?

Why do email attachments stop being safe once you press send?

Secure document sharing starts with one fact: an attachment is a copy, and a copy has no password, no end date and no off switch. A contract pack goes to a client on Monday, gets forwarded to their accountant on Tuesday, and by Thursday three copies sit in three inboxes.

• Nobody can say who still has it. Once the file leaves, your only control is asking people to delete it.
• Forwarding is invisible. You never see the second and third recipients, so you cannot judge whether they should have it.
• Access never ends by itself. The file stays in every mailbox long after the job is done.
• The fix is a change of idea. The file stays where it is, and outsiders get a controlled way to reach it, which is what good file sharing with clients looks like.

What should a secure link for documents control?

A link is only as safe as the settings behind it. Before you send one, check these four things.

1. Password. A password protected link will not open for whoever the message gets forwarded to. Send the password on another channel, not in the same email.
2. Expiry date. The link stops working on the date, so nobody has to remember to close it.
3. Open limit. The link opens a set number of times and then stops. Download limits work the same way.
4. View-only. Readers see the document in a watermarked viewer with download and print disabled.

SK Drive puts these controls on every link, and the password is hashed and never shown to Softknack. You can also restrict a link to people signed in to your organisation, which suits internal handovers.

How do you collect files from a client without giving them an account?

Sharing is only half of the job. Getting documents back, such as signed forms, statements and site photos, usually means a chain of replies saved by hand. A file request reverses the direction: you send a link and the client uploads straight into a folder you chose.

1. Create the request. Set the target folder, allowed file types, size cap and deadline.
2. Send the link. The client uploads without creating an account.
3. Let the scan run. Every upload is scanned before anyone on your side opens it.
4. Close it when done. Closing the request ends the link.

Picture a month end where ten clients each send a bundle. Each bundle lands in the folder you set for that client, and nobody sorts an inbox. Once documents arrive, keep one current copy and track changes with document version control.

When should you give someone a role instead of a link?

A link suits a one-off handover. For a partner agency, an auditor or an outside adviser you work with every week, file sharing permissions tied to a person are better, because one person's access can change without touching anyone else's. This is the least privilege idea: NIST defines it as giving each entity only the minimum authorizations and resources it needs to perform its function.

• Four roles. SK Drive offers viewer, commenter, editor and manager, given on files or whole folders, for people or groups.
• Spaces keep it tidy. Organisation, team and personal spaces each have their own roster, and a personal space stays private until shared.
• One team space per client project. Your people are editors, and each outside reader sees only the folder they need.
• Leave the team, lose the access. Nobody has to remember which links went to whom.

How does secure document sharing compare with email in a normal week?

Mostly it removes guesswork, because each job gets the right door: a link for a handover, a request for incoming documents, a role for ongoing work. The table shows the same situations side by side.

• Choose the door first. Ask whether this is a one-off, an inbound batch or ongoing work before you share anything.
• Share the smallest thing. Send one file or one folder, not a whole drive.
• Skip the security team. The habit of choosing the right door does most of the work.

How do you shut access off when the work ends?

Sharing is easy to start and easy to forget. Treat the end of the job as part of the share, and follow the advice in OWASP's authorization guidance to review permissions periodically for privilege creep.

1. Set an expiry up front. The date closes the link for you.
2. Revoke by hand when there is no date. In SK Drive you can revoke a link in one tap, and the next click fails with no stale copy left behind.
3. Close file requests. Once the documents are in, close the request.
4. Transfer a leaver's files. An admin moves personal files, owned shared folders and workspace items to a named manager in one step. Shares and links survive and only the owner changes.
5. Check the record. SK Drive records every share, revoke, transfer and purge, so you can answer when a client asks who had access.

To see how your folders would map to spaces and roles, book a SK Drive demo and start by listing every link you have shared this month.

FAQ