Client file security in 2026: where your delivered files really live

Most client files are exposed by sprawl, not by hackers. The file you sent last year sits as an attachment in two inboxes, a transfer link that may never have expired, and a shared folder you never closed. Fix it by delivering work from one controlled place tied to each client, turning on two-factor authentication, and closing old public links.

The weak link is rarely a master hacker

Start with how breaches actually happen. Verizon's Data Breach Investigations Report, the standard annual reference, says the most frequent causes continue to heavily involve the human element, including social engineering, phishing and stolen credentials. Not clever code. People, and the passwords protecting their accounts.

The UK government's Cyber Security Breaches Survey says the same from the victim's side: phishing was the most prevalent type of attack by far, hitting 38% of businesses. IBM's Cost of a Data Breach report found stolen or compromised credentials were the most common way attackers first got in, at 16% of breaches.

This matters for a small business because every one of those attacks targets an account and its password. When client files live in your personal email and personal drive, the thing standing between a stranger and your client's confidential work is that password and whether you turned on two-factor authentication. That is the same wall protecting your holiday photos.

"Anyone with the link" does more than you think

The bigger problem is not a break-in. It is access you handed out and forgot.

Varonis analysed 1,000 real IT environments with nearly 10 billion files and found that 66% of companies had cloud data exposed to anonymous users. "Exposed to anonymous users" usually means anyone-with-the-link sharing, the default most people click through without thinking. If companies with IT departments leak data this way, a one-person business juggling a dozen shared folders is unlikely to beat the average.

Think about what a shared link is. It does not know who the client is. It does not expire when the project ends. It does not tell you who opened it. Forward it once and it forwards forever. A folder shared in 2024 has given standing access to your client, to everyone the client forwarded it to, and to anyone who later gets into any of their inboxes. You cannot secure what you cannot see, and a link is built to be invisible once it leaves your hands.

"Too small to be a target" is a myth

The comforting story is that this is an enterprise problem. The data disagrees. The same UK survey found that 43% of businesses had a breach or attack in the last 12 months, and that 30% of micro businesses regard cyber security as a low priority. Attackers do not pick victims by prestige. They send phishing to whoever has an inbox, and the smallest operations are often the least defended.

The cost of being wrong is not abstract either. IBM put the global average cost of a data breach at $4.88 million in 2024. A solo business does not carry a bill that size, but your client might, and if the leak traces back to the folder you left open, you are the reason it happened. That is a conversation you do not recover a referral from.

Your client is grading you on this

Security is also a sales issue. Clients increasingly expect you to handle their material properly, and some check. In a freelancermap survey on NDAs, 62% of freelancers said they sign an NDA on most projects. So most of your clients care enough about confidentiality to put it in writing.

Now line that up with reality. The client made you promise to protect their information, and you delivered the work over a public transfer link and parked the source files in a personal drive shared with "anyone with the link". The promise and the practice do not match. Most clients never find out. The ones who do, often the better-paying ones, conclude you are not ready for serious work.

Deliver from one controlled place

The fix is consolidation, not paranoia or an enterprise budget. Most of this risk comes from client work scattered across personal accounts and public links that you neither track nor revoke. Put delivery in one controlled place and most of the exposure goes away.

That place needs to know who the client is, to keep everything for one client together, and to let you close access when the job ends. A shared drive can do part of that if you configure every folder carefully. A per-client portal does it by default. For the comparison, see client portal vs shared drive and our guide to sending large files without WeTransfer.

A five-minute cleanup

You do not need to become a security engineer. Close the obvious doors in this order.

1. Turn on two-factor authentication on your email first, then your file storage. Stolen credentials are the most common way in, and this is the cheapest thing that blunts them.
2. Audit your shared links today. Open your drive or Dropbox, look at everything set to "anyone with the link" and turn off the ones for finished projects. Most people find years of open doors.
3. Stop using public transfer links as your default. A link anyone can open and forward is the wrong tool for confidential work, however convenient it feels.
4. Give each client one place, not five channels. One controlled space per client removes most of the exposure and most of the "where did you send that file?" messages.
5. Revoke on the way out. When a project ends, close access. If you cannot easily do that, the work was living somewhere it should not have been.

None of this is heroic. It is the difference between a business a serious client can trust with private material and one that is a forwarded link away from an awkward apology.

How Delivvo keeps delivery in one controlled place

Delivvo delivers work through a per-client portal instead of a public link. It is not a full security programme, so keep your own login protected too.

1. Each client gets their own portal. It opens with a one-time code sent to their email, so there is no shared password to leak and no public URL to forward.
2. Files, versions, approvals and messages for that client sit in one place under your business name, next to the contract and invoice.
3. Heavy files go through the same portal. You can upload files up to 50 GB each on the Pro plan and above, with resumable uploads, which is the moment people usually reach for a public transfer link. Clients can send files back up to 5 GB each.
4. Your team sees only what their role allows. Roles, reach and an audit log show who did what, and the client only ever sees the approved file.
5. Payment gateway credentials are stored encrypted with AES-256-GCM, and the database uses row-level security. Delivvo takes 0% of payments, and the money goes straight from your client to you.

Delivvo will not fix a weak password on your own account, and it is not endpoint protection or a password manager. What it removes is the specific, common failure: confidential client files in personal accounts and behind forwardable public links, with no control and no visibility. That is most of the practical risk, and you can close it this week. Look at the client portal, the large file delivery page and data security.

For the wider picture, see client approvals and the CRM for service businesses.

FAQ