Cloud Drive Sharing: Which Setting Is Public?
6 min read
Most small business data leaks are not break-ins. Somebody set the quotes folder to anyone with the link three years ago, that link then travelled through email, group chats and a contractor's laptop, and nobody ever pulled it back. Cloud drives made sharing so easy that people stop noticing what the option they clicked actually does, which is to put the file somewhere on the internet that anybody can reach. This covers what each sharing level really grants, what has to be revoked on the day somebody leaves, and how to spend half an hour finding out who can still see what.
1. The usual route out is not an intrusion. You opened it
Whoever holds a sharing link needs no password and no vulnerability. The address is the key, and opening it involves no step that asks who you are. That is a different problem from an admin panel being brute forced, and it is why firewalls, antivirus and vulnerability scans never see it.
Links travel. Mail gets forwarded, somebody pastes it into a group, a contractor saves it locally, a salesperson drops it into a document for a client. Every hop takes you one step further from knowing where it currently is. By the time you want it back, you cannot even list which links you have handed out.
If that folder holds customer lists, orders or staff identity data, this stops being merely embarrassing. In Taiwan the Personal Data Protection Act, the PDPA, puts a duty of care on whoever holds personal data, and a leak can bring notification and compensation obligations with it. Most jurisdictions have an equivalent, so check which one covers the people whose data you actually hold. Either way, we were not hacked, our sharing setting was too wide is not a better answer at the review meeting.
2. Sharing has two layers and most people see one
The sharing dialog holds two separate decisions. The first is who can open the file. The second is what they can do once it is open. Most people only adjust the first, which is how a file ends up with the right people and the wrong permissions.
In Google Drive the first layer is called general access and has two states: restricted, or anyone with the link. The second layer is the role, and the official sharing documentation splits it four ways. What each role can actually walk away with differs more than the names suggest.
| Role | What it can do | What gets overlooked |
|---|---|---|
| Viewer | Open and read | Can download by default, which means keeping a private copy |
| Commenter | Read and comment | Cannot change the content, but still receives the whole file |
| Editor | Read, change, download | Can re-share the file to other people and adjust permissions |
| Owner | Everything, including deletion | Only one person. Transfer it away and the file is no longer yours to control |
The third row is the one people underestimate. Give a colleague editor access and they can hand the same file to a third party without you being told. An owner can turn that off in the advanced settings, and can also stop viewers downloading and printing, but both are on by default.
3. What anyone with the link actually means
The wording is gentle. The behaviour is not. No sign-in, no need to be a colleague, no need for you to know the person, and no need for a Google account at all. People who are not signed in appear in the file as anonymous animals, so you can see that somebody is reading and you will never know who.
There is also a feature many people assume exists: expiry. A sharing link does not lapse on its own, and the expiration date setting is only available on eligible work or school accounts. On an ordinary account, open it now and revoke it later is in practice the same as open forever.
4. On the day somebody leaves, the account is not the whole job
Suspending the account is the first move, and it does not expire the links that person created, nor does it claw back the files they shared to a personal address. The person goes, the access stays. That is what an audit turns up most often.
Five things for the week somebody leaves
- Transfer file ownership first, then suspend the account. In the other order, files owned by that account can disappear with it, including the ones a whole department works from.
- Reclaim files shared to a personal mailbox. Sharing a copy of work files to a private account is common, and that copy does not vanish when the company account is suspended.
- Check the links they created. Files they set to anyone with the link stay public after they leave, and changing the owner does not close them either.
- Rotate shared credentials. Department mailboxes, admin panels, social accounts: anything several people log into gets a new password that day, not at the next scheduled rotation.
- Close out contractors and finished projects at the same time. Agencies whose work is done and project folders that already shipped tend to keep access longest, because nobody owns the question.
Write those five into the leaver process as a list. Handover of duties gets chased by somebody. Handover of access generally does not, unless it becomes a document that has to be signed off.
5. Half an hour a quarter: who can still see what
The first question in an audit is who can currently open this file. Right-click a file or folder in Drive and open the file information panel, and it lists the owner along with everybody who has access. The official page on stopping sharing covers removing people one at a time and setting general access back to restricted.
Going through every file is not realistic, so choose. The practical version audits three kinds of folder only: finance, customer data, and personnel. Those carry the highest cost if they leak, and there are few enough of them to finish in half an hour. Leave the rest. An audit you can finish is one that happens twice.
Once the audit is done, change the default habit. When an outside party needs a file, share it to their address rather than by link. Links are for material where you neither know nor care who opens it, such as a public product catalogue. A financial report is not that.
6. What permissions can and cannot do
One honest limitation: permissions do not restrain a person who has permission. They can screenshot it, save a copy, or paste the contents somewhere else a paragraph at a time. Turning off download and print raises the effort slightly and is not protection. Treating it as protection is how people end up overestimating where they stand.
So the question worth asking is not how to lock this down harder. It is whether this person needs to see this file at all. Grant access at the size of the actual need and the residual risk becomes small enough to live with. That is also why auditing beats configuring: configuration is a one-off act, and the audit is what tells you the need changed months ago.
One boundary on scope. This is about hosted services like Google Drive and OneDrive. If your files also sit on a file server or a NAS in the office, that is a different layer with different logic and a much higher cost to exposing it. That part is covered in the piece on NAS security.
A sharing link is a key with no sign-in step, no expiry date, and a habit of travelling on its own. Most companies have never counted how many they have handed out. Two things are worth doing today: review access on the finance, customer and personnel folders, and write down what gets revoked when somebody leaves. Neither costs money or needs a technical background, and together they address the most common way a small business loses its data.
Common questions
- Is anyone with the link safe to use?
- That option puts the file on the internet, where anybody holding the address can open it without signing in and without being someone you know. You cannot tell who read it either, because visitors who are not signed in show up only as anonymous animals. It suits public catalogues and general documentation. It does not suit quotes, customer lists or personnel files. For a specific outside party, share to their email address instead.
- After an employee leaves, are the files they shared still out there?
- Yes. Suspending an account does not expire the links that person created, and it does not reclaim the copy they shared to a personal mailbox. In the leaving week, transfer ownership of their files before suspending the account, then check the links they created, reclaim anything shared to personal addresses, rotate shared credentials, and close access for contractors whose work has finished.
- If I set a file back to restricted, is the earlier exposure resolved?
- Only half of it. Restricted means nobody outside the named list can open the file from now on, which does stop further access. Copies already downloaded or screenshotted cannot be recovered, and that content has left your control. The real lesson is not to share sensitive material by link in the first place. Where personal data is involved, assess your notification duties separately.