Most small businesses still move client files the way they did fifteen years ago. Attach the document, hit send, hope for the best. It works often enough that nobody questions it, and when it goes wrong it goes wrong quietly. Nobody gets an alert that says “your client’s tax return is now sitting in a stranger’s inbox.”
We are not here to tell you email is evil. Email is great for conversation. The problem is that an attachment is a copy, and a copy is permanent. The second it leaves your outbox you have handed control of that file to whoever ends up holding it, forever. There is a better way, it is not expensive, and most businesses already own the tools.
Why The Attachment Habit Is Worse Than It Feels
Attachments feel private because you addressed the message to one person. But an attached file has no memory of where it came from and no rules attached to it. Here is what you give up every time.
- No expiry. That proposal you sent in 2019 is still in somebody’s mailbox, their archive, and their provider’s backup, long after your pricing and staff have changed.
- No revocation. Send the wrong version and there is no button that pulls it back. Recall features mostly do nothing once a message leaves your own mail system.
- It gets forwarded, and you never know. Your contact leaves and forwards their whole mailbox to a personal account. Your file goes with it.
- Size limits push people to worse tools. When a file bounces, nobody reconsiders their security posture. They upload it to whatever free service appears first. That is the pattern we describe in shadow IT and the hidden risk inside your own organization.
- The wrong recipient disaster. Autocomplete picks the wrong Jennifer. You do not notice for two days. Depending on what was in that file, you may now have a notification obligation.
That last one is not a freak event. Verizon’s 2025 Data Breach Investigations Report found the human element was involved in roughly 60 percent of the breaches it analyzed. The fix is not telling your team to be more careful. It is changing the tool so being in a hurry stops being dangerous.
What A Secure Link Gives You Instead
Share a link instead of a copy and the file stays in one place you own. The link is a key, and you decide what it opens, who it works for, and how long it lasts. Microsoft’s documentation for OneDrive and SharePoint spells out the trade offs plainly, and most business platforms follow the same three tier pattern.
- The open link is convenient and risky. Microsoft describes an “Anyone” link as “transferable because it can be forwarded to others,” and notes that people using it “don’t have to authenticate, and their access can’t be audited.” It still beats an attachment on one count: Microsoft notes you can “revoke access for everyone who used the link by deleting it.”
- The internal link keeps files inside the company. Microsoft’s docs state that opening a “People in my organization” link requires being “authenticated as a member in your directory,” and confirm administrators can configure expiration policies so newly created links stop working after a set date.
- The named recipient link is for sensitive material. Microsoft describes a “Specific people” link as “a nontransferable, revocable secret key,” and says the recipient “needs to authenticate as the user specified in the link.” Forwarding it does nothing. That is the entire point.
Menu names and features change, so confirm current options and pricing on your own platform. The underlying idea is durable: a link you can name, time limit, and switch off beats a copy you can do none of those things to.
Decide What Needs A Login
Requiring a login for everything teaches clients to hate working with you. Requiring it for nothing lands you in a breach conversation. Sort your material into three buckets and stop agonizing over individual files.
- Public and promotional. Brochures, case studies, capability decks. An open link is fine.
- Business confidential. Proposals, statements of work, drawings, pricing. Named recipient link with an expiration date.
- Regulated or personally sensitive. Financial account details, health information, government identifiers, employee records. Login every time, no exceptions, ideally with a second factor.
Write those three buckets on one page with examples from your actual business. That page settles more arguments than an hour of training.
Let Clients Send You Things Safely Too
Half the risk runs the other direction and almost nobody plans for it. You ask a client for their driver’s license or two years of returns, and they do the obvious thing: they attach it to an email. Now the most sensitive document in the relationship sits in two mailboxes, and you asked for it that way.
Most business file platforms support an upload link, sometimes called a file request. You send one link, the client drops files into a folder you control, and they cannot see anything else in it or anyone else’s submission. Setup takes about a minute, and you can save a reusable one for recurring intake. Put it in your onboarding email, your intake form, and your signature. Given an easy path, most clients take it.
Make The Secure Way The Easy Way
Every secure file sharing rollout that fails, fails for one reason: the secure path had more steps than the insecure one. People are not lazy. They are busy, and they route around friction every time. Do not out policy them. Out design them.
- Change the defaults, not the humans. Set the default link type to named recipients with an expiration, so the safe option is what happens when nobody thinks about it.
- Put the tools where the work happens. Sharing should be a button inside the app people already have open, or it loses to the paperclip icon.
- Give clients a script. A friendly line in your signature explaining that you send and receive documents by secure link reads as professionalism, not paranoia.
- Fix the big file problem first. The teams who regularly hit size limits are your highest risk group and your best early adopters.
- Turn off the old way last. Once usage is high, block attachments over a certain size or containing certain data, with a message pointing to the right tool. Blocking too early just generates workarounds.
Speed is the real argument here, not fear. A shared folder both sides can see beats fourteen emails of “final_v3_REVISED,” which is the same logic we lay out in why saving time takes priority over saving money.
The Bottom Line
The email attachment is not a security policy. It is a habit from an era when we had nothing better. You now have links that expire, links that only work for the person you named, links you can switch off from your desk, and upload links that keep clients from emailing you their identity documents. Most of that is already in the subscription you pay for.
Start small. Move the workflow carrying your most sensitive material to secure links this month and check whether it made anyone’s day harder. Six weeks of that and the attachment habit dies on its own, because nobody misses it.
If you are not sure what your current file sharing tools can actually do, or the policy exists but nobody follows it, we can audit how files really move through your business and set up a system your team will use without being nagged. We work with small and mid sized businesses across Denton County and the surrounding area. Contact us today
Sources:
Comments are closed