Secure storage is only the beginning
A document sits in a protected folder while copies exist in email, on a desktop and behind a link with no expiry. Each version has its own recipients. Access control needs checking throughout the file’s creation, transfer, use and retirement.
Imagine a contractor's estimate
Imagine a fictional office renovation. A manager receives a general estimate containing prices, internal discounts and employee contact details. The contractor needs room dimensions and agreed work. To avoid delaying approval, the manager sends the entire file through a familiar messenger. Access to the original folder is correct, but the sharing boundary has already been crossed.
The problem begins with an inconvenient process: a suitable external version must be assembled manually. A fix might include an export template and an agreed transfer channel. Banning forwarding without a convenient working route leaves the reason for bypassing rules in place.
What the recipient may actually do
Reading, editing, downloading and giving others access are different capabilities. Establish which ones the service supports and which are enabled by default. A label saying access is by link does not explain whether sign-in is required or whether that link can be forwarded.
Our practical method is to describe each transfer in one sentence: to whom, which information, for which action and until when. If that sentence cannot be completed, permission is too vague. Interface restrictions cannot guarantee the disappearance of an already received copy: controlling the source differs from controlling every subsequent instance.
Copies complicate corrections
Suppose a price changes in the estimate. Updating the source does not automatically fix an old email attachment. Staff may continue approving different versions, while a leak investigation faces an unknown number of copies. Accuracy and confidentiality both benefit from keeping a clearly identified master copy.
Examine temporary files, analytics exports and synchronisation folders too. Not every copy needs to be prohibited. A necessary copy needs a purpose, owner and removal procedure after the task ends. Deleting a link does not establish that a previously downloaded file was deleted.
Test with one document
Choose an ordinary document without sensitive information and reproduce its journey under authorised test conditions. Ask participants to demonstrate their actual steps, including intermediate saves. Note where copies arise, who receives access and how users recognise the current version. Compare observed behaviour with the team's understanding of its rules.
Then test two changes: completion of the contractor's work and correction of a document after sending. A useful finding is a concrete discrepancy, such as a still-active link or an export with no known owner. A list of installed protection tools cannot provide that answer.
Fix handovers, not an idealised diagram
First fix one frequent, inconvenient transition: preparing an external version, approving recipients or closing temporary access. Assign somebody to check the change in the next similar case. Otherwise the new instruction will drift away from practice just as the old one did.
