Most organizations lose files through ordinary habits: a tax return emailed as an unencrypted attachment, a OneDrive link set to “anyone” that gets forwarded, a USB drive left in a laptop bag, or a shared folder half the office can open when two people should. Secure file sharing for business comes down to picking the right place to store a file and the right way to send it, and the tools are usually already in your Microsoft 365 subscription.
Secure storage means four things: only the right people can open the file, it is encrypted so a stolen copy is unreadable, you can see who accessed it, and you can get it back if it is deleted or encrypted by ransomware.
Talk to an advisor
Ask about your own setup.
We ask what you’re trying to accomplish and tell you what we’d look at first. It costs nothing to talk, and no price comes up on this call.
Secure file sharing for business starts with storage
| Option | Who controls it | Verdict |
|---|---|---|
| SharePoint, OneDrive and Teams | Your organization. Encrypted, access-controlled and logged. | Your default for business files |
| On-premises file server | Your organization | Fine when patched, backed up and carefully permissioned, with a secure way to reach it remotely |
| Personal Dropbox, Google Drive or iCloud | The employee | Avoid. The business can’t see, control or recover what is there. |
| Local desktops and downloads folders | Nobody, really | Often not backed up, and lost when a laptop dies or is stolen |
| USB drives and external disks | Whoever is holding it | Easy to lose. Use encrypted drives with an inventory, if at all. |
Which sharing link to use
Microsoft 365 offers three main kinds of sharing links in SharePoint and OneDrive, and the choice matters more than most people realize.
| Link type | Who can open it | When it fits |
|---|---|---|
| Anyone | Whoever has the link, with no sign-in. Microsoft notes you can’t track who has access. | Non-sensitive material only, ideally view-only and set to expire |
| People in your organization | Signed-in members of your Microsoft 365 organization | Internal documents |
| Specific people | Only the people you name. Outside recipients sign in or enter a one-time code. | Client files and anything sensitive |
Settings to review with your IT provider: make specific people or your organization the default link type, require anyone links to expire or turn them off, set guest access to expire automatically, and limit external sharing to approved domains where that fits. Most Microsoft 365 tenants we review still run on Microsoft’s defaults, so these settings have often never been touched. Our Microsoft 365 services include this configuration.
How to send sensitive files: secure file transfer options
- Prefer a link over an attachment. A specific-people link can be revoked later, and an attachment can’t.
- Use encrypted email for anything containing Social Security numbers, financial account details, health information or legal matters. Microsoft Purview Message Encryption is included in Business Premium and E3/E5 plans, and can be added to others.
- Use a client portal for regular document exchange, such as tax returns or medical records.
- Use SFTP or a managed transfer service for large or automated transfers with partners.
- Send passwords separately. If a file is password-protected, share the password by phone or text, never in the same email.
- Double-check the recipient before you hit send, since autocomplete sends plenty of files to the wrong person.
- On public Wi-Fi, use your phone’s hotspot or your company’s secure remote access.
Secure file sharing for accountants and law firms
Tax returns, engagement files and case documents are the files most likely to go out as email attachments, and they’re the ones professional rules care about.
Accounting and tax firms
in August 2026 the IRS reminded tax professionals that federal law requires them to keep a written information security plan, and the FTC Safeguards Rule requires encrypting customer information sent over external networks. A client portal, or specific-people links with encrypted email for anything you send, covers the exchange. IRS Publication 5708 is a free template for the plan itself.
Law firms
ABA Formal Opinion 477R (2017) says lawyers may use email and cloud services but must make reasonable efforts to prevent unauthorized access, and that highly sensitive matters can call for stronger measures such as encryption. A document system with controlled external sharing, or specific-people links that expire when the matter closes, fits that standard better than attachments.
Both
give clients one way to send documents to you, such as an upload link or portal, so W-2s and signed agreements stop arriving by email. Remove outside access when an engagement ends.
See how we work with accounting firms and law firms.
Encryption changes your legal position
53%
Share of breached organizations in IBM’s 2026 Cost of a Data Breach Report that had not encrypted sensitive data at rest and in transit
Encryption is one of the few controls that changes what happens after an incident. Under HIPAA, breach notification applies to unsecured protected health information, and HHS treats properly encrypted data as secured. The FTC Safeguards Rule requires covered financial firms, including tax preparers and many accounting practices, to encrypt customer information at rest and in transit over external networks, and its breach reporting rule applies to unencrypted information.
- 01Turn on BitLocker on Windows laptops and FileVault on Macs, with recovery keys kept in a managed location.
- 02Require a passcode on phones and tablets and manage them, so company data can be wiped if one is lost. Our BYOD policy guide covers personal phones.
- 03Add sensitivity labels so the most sensitive documents stay encrypted after they leave SharePoint. Microsoft 365 already encrypts stored files.
- 04Encrypt backups too, including any off-site copy.
Keep permissions tight and files recoverable
Most oversharing comes from permissions that grew over time. Grant access by role using groups, review sensitive folders such as HR, payroll, client tax files and patient records on a schedule, and require MFA for every account that can reach company files, including guests where possible. Remove access the day someone leaves, including links they created for outside parties. For our clients, access is disabled the same day the client asks, and our offboarding checklist covers the rest.
Recycle bins and version history help with everyday mistakes, but they are not a full backup and won’t cover every ransomware or long-term deletion scenario. For our clients, Microsoft 365 and Google Workspace data is backed up three times a day and is immutable. Server backups run hourly, copy off-site daily, are immutable and are verified with screenshots, and all of it is stored in the US. See our guide to secure data backup and our business continuity services.
The first habit to change is the client file sent as an email attachment. For a look at how your sharing settings are set today, and how they line up with your compliance obligations, book a 15-minute call.
Related reading
Frequently asked questions
What is secure file sharing?
Secure file sharing means storing and sending files so only the right people can open them, a stolen copy is unreadable because it’s encrypted, you can see who accessed them, and you can get them back if they’re deleted or hit by ransomware. For most offices, the tools to do it are already in their Microsoft 365 subscription.
What is the most secure way to share files for a small business?
For most small businesses on Microsoft 365, SharePoint and OneDrive with specific-people links are the safest default: you control access, can see who opened a file and can revoke the link later. Add MFA, expiring links and backups. Use encrypted email or a client portal for Social Security numbers, financial details or health information. Microsoft offers a HIPAA business associate agreement that covers SharePoint Online and OneDrive for Business.
How do you share files securely?
Send a link instead of an attachment, set to specific people so outside recipients have to sign in or enter a one-time code. Use encrypted email for anything with Social Security numbers, financial account details, health information or legal matters, and SFTP or a managed transfer service for large or automated transfers. If a file is password-protected, send the password by phone or text, never in the same email.
Is it safe to email tax documents?
Not as a plain attachment. An unencrypted email can be forwarded, sits in mailboxes indefinitely and can’t be recalled. The FTC Safeguards Rule requires covered firms, including tax preparers, to encrypt customer information sent over external networks. Use a client portal, an upload link, or encrypted email with specific-people links, and give clients one way to send documents to you.
Is SharePoint secure for sensitive data?
It can be. Microsoft 365 encrypts stored files, access is tied to signed-in accounts and activity is logged, but security depends on settings. Make specific-people links the default, restrict or expire anyone links, require MFA, review folder permissions on a schedule and add sensitivity labels. Back it up separately too, since recycle bins and version history aren’t a full backup.
Sources
- Baker Donelson, Ten takeaways from IBM’s 2026 Cost of a Data Breach Report
- IBM, Cost of a Data Breach Report 2026
- Microsoft Learn, Manage sharing settings for SharePoint and OneDrive
- Microsoft Learn, How shareable links work in OneDrive and SharePoint
- eCFR, 16 CFR 314.4, Safeguards Rule elements
- FTC, FTC Safeguards Rule: What Your Business Needs to Know
- HHS, HIPAA Breach Notification Rule
- eCFR, 45 CFR 164.312, HIPAA technical safeguards
- Microsoft Learn, Encryption in the Microsoft cloud
- Microsoft Learn, HIPAA and HITECH Act offering
- Microsoft Learn, Microsoft Purview service description: Message Encryption
- IRS: Security Summit reminds tax pros they need a written information security plan, August 2026
- ABA Journal: Lawyers must secure client communications (Formal Opinion 477R)
Next step
Let us handle this for you.
We tell you which rules apply, put safeguards in place and hand you the policies.
- 15 minutes
Tell us which question brought you here and how your office runs.
We’ll tell you how it applies to you and what we’d look at first.
If we’re not the right fit, we’ll say so.
15 minutes
