Shared Document Links Anyone Can Open

The link instead of the attachment

Sharing a file from online storage is quicker than attaching it. A link to the quote, the contract or the folder of photos goes into an email, and the recipient clicks.

The most convenient sharing setting, and on many services the one offered first, lets anyone who has the link open the file. No account, no password, and usually no record of who looked.

The link then lives wherever the email goes. It is forwarded, quoted in replies, pasted into other documents and saved in someone's notes.

Years later it still opens the file, and often a good deal more.

What sits behind old links

• Quotes and price lists sent to people who never became customers.
• Signed contracts with names, addresses and signatures.
• Customer files such as plans, photographs or forms.
• Whole folders shared once for a single file.
• Spreadsheets of customers, staff or suppliers.
• Drafts that were never meant to leave the office.

The fourth is the one that grows. A link to a folder opens whatever is in it now, not what was in it then, so every file added since is open to anyone holding the original link.

Three levels of sharing

Most online storage services offer some version of the same three choices.

Named people can open a file only after signing in. Anyone in your organisation can open it with a business account. Anyone with the link can open it without signing in at all.

The third is convenient precisely because it checks nothing. That makes it right for a brochure and wrong for a contract.

Some services add a fourth level, public on the web, which lets search engines find and list the file. That one should be rare.

Links travel further than you think

A prospect forwards your quote to two competitors to ask for a better price. A client forwards the folder link to their contractor, who passes it to a subcontractor.

A former employee still has the email, on a phone that was never wiped. A link pasted into a shared document is now visible to everyone who can see that document.

And a link posted even once on a public page can be picked up by search engines, along with whatever it opens.

None of this requires anyone to break in. The link simply works, for whoever has it.

A worked example

A literary agency with three agents and an assistant shares manuscripts with editors at publishing houses, and contracts and royalty statements with its authors, through an online storage service.

When the assistant went through the service's list of shared items, she found well over a hundred links that worked for anyone, some of them six years old.

One had been created for a co-agent abroad who needed a single contract. It pointed to the folder holding every author's contracts, and each contract saved there since had been reachable through it.

There was no way to know whether anyone else had ever used it. That was the uncomfortable part.

The agency removed every link for finished work, switched contracts and statements to named people, and now shares single files rather than folders.

Links to manuscripts expire after a month, which its plan allows, and a review goes in the calendar each quarter.

Finding what is already shared

Most services have a page listing the items you have shared, or a way to search for them. Business plans often give an administrator a way to review sharing across every account.

Start with folders, then with anything shared to anyone with the link. Sort by date: the oldest links are the ones nobody remembers.

If the list is long, ask whoever looks after your accounts and computers to help. It is a few hours, not a project.

Choosing the narrowest setting that works

Share contracts, customer files and anything with personal information with named people only. Make it view-only unless the other person genuinely needs to edit.

Share single files rather than folders whenever one file is all the person needs.

When a file must go to someone without an account, a password on the link, where the service offers one, adds a second check.

Keep links that anyone can open for material you would happily publish, such as a brochure or a public price list. Better still, put those on your website, where you control them.

Making links expire

Some services let you set an expiry date on a link, often only on paid or business plans. Where yours does, use it: a link to a quote can expire when the quote does.

Where it does not, expiry has to be done by hand. When a job closes, remove the links that belonged to it, as part of closing the file.

Business accounts may also have an administrator setting that limits or switches off links that work without signing in. Worth asking about before the next review.

When someone leaves

Files shared from a departing employee's account are easy to lose track of. The links they created keep working for as long as the account and the files exist.

Before the account is closed, have its files transferred to someone who is staying, then review what had been shared, and with whom.

Closing an account without a transfer can also delete files the business still needs, which is a different problem and an equally unwelcome one.

The counter-case

Some files are meant to be public, and a link anyone can open is fine for them. A business that rarely shares files may find only a handful of links to tidy.

Named sharing can also be awkward for recipients without an account on the same service. For them, a link set to expire within days is a practical compromise.

For anything with a signature, an address or a price you would not publish, though, the rule stands: named people, single files, and links that end when the job does.

The first review

1. Open the list of items you have shared.
2. Start with folders shared by link.
3. Switch contracts and customer files to named people.
4. Remove links for finished jobs.
5. Set expiry dates where the service allows.
6. Ask about company-wide limits on link sharing.
7. Book a quarterly review in the calendar.

Step two is where the largest exposure usually hides, since a folder link widens every time someone saves a new file into that folder.

Files that leave the office in someone's pocket are covered in lost phones with business email on them.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.