Every business moves files. Contracts to clients, records between offices, images to a specialist, statements to an accountant. Most of them do it by email attachment, which is convenient, universal, and the least secure option available.
This is a practical guide to doing better — without buying anything exotic and without making your team’s life harder.
Why email attachments are the wrong tool
An emailed file leaves your control the moment you press send. It sits in the recipient’s mailbox indefinitely, gets forwarded without your knowledge, and lands in backups on servers you do not administer. If it went to the wrong address, there is no recall. If the recipient’s mailbox is later compromised, your file is in the breach.
Attachments also cannot be revoked, cannot be expired, and produce no record of who opened them. For anything containing patient information, financial details, or personal data, that combination is a problem — practically and, in regulated industries, legally.
Understand the two kinds of encryption
Two terms come up constantly and get conflated.
Encryption at rest protects the file where it is stored. If a laptop is stolen or a drive is pulled from a server, the data is unreadable. BitLocker on Windows and FileVault on Mac provide this, and every business device should have it enabled.
Encryption in transit protects the file while it moves across the network. This is what TLS does.
You need both, and having one does not give you the other. A file encrypted at rest on your server travels in the clear if it is sent over an unencrypted protocol.
Storage: pick one place and mean it
The most common storage failure in small businesses is not weak encryption. It is sprawl — the same document living on a desktop, a USB stick, a personal Dropbox, and a shared drive, in four different versions with no way to tell which is current.
Pick a primary location — for most Microsoft 365 businesses that is SharePoint for shared work and OneDrive for individual work — and make it the only sanctioned place business files live. Then make it easy: Known Folder Move redirects Desktop and Documents into OneDrive automatically, so people do not have to remember.
Set permissions by group rather than by individual, so access can be granted and revoked by changing one membership. Review who has access to the sensitive libraries at least annually. And be specific about personal cloud accounts: a file in an employee’s personal Google Drive is outside your control entirely and leaves with them.
Transfer: use links, not attachments
For most business file sharing, a permissioned link to a file in your own storage is the right answer. It stays under your control, it can be revoked, it expires, and it logs access.
When you create the link, take four seconds to set it correctly. Share with specific people rather than “anyone with the link” whenever the content is sensitive. Set an expiration date. Choose view-only unless editing is genuinely needed. For highly sensitive material, add a password and send it through a different channel than the link itself.
Where a recipient truly cannot handle a link — some insurers and government offices still cannot — encrypted email is the fallback. Microsoft 365 Message Encryption and similar tools deliver the message through a secure portal rather than as an open attachment.
Protocols to stop using
Plain FTP sends credentials and file contents unencrypted. If you still have an FTP server, replace it with SFTP or retire it. The same goes for unencrypted network shares reachable from outside your building, and for consumer file-sharing sites used for business documents.
USB drives deserve a specific mention. They get lost, they carry malware between machines, and they are almost never encrypted. If your workflow requires them, require hardware-encrypted drives and log who has them.
The part that is not technical
Two habits prevent more incidents than any product. First, check the recipient before sending — misdirected email is one of the most common causes of small-business data exposure, and autocomplete is the culprit. Second, share the minimum: one file rather than the folder, view rather than edit, this quarter rather than the whole archive.
Write the rules down in a page anyone can follow, and cover the exceptions people actually hit. A policy that does not answer “what do I do when the insurance company insists on a fax?” will be ignored the first time that happens.
If you would like help setting up sharing controls that are secure without being obstructive, let us know. Getting the defaults right is most of the work.