Secure File Storage and Transfer for Business

Here's a small experiment. Think of a contract your business sent to a client last year as an email attachment. How many copies of that file exist right now?

Let's count. One in your Sent Items. One in the client's inbox. If you copied in a colleague, one more. If the client forwarded it to their accountant, another. Each mailbox is probably backed up, so double the count. Someone likely saved it to their Downloads folder. We're at eight or more copies, in places you don't control, with no expiry date, and you couldn't delete them if you wanted to.

That's the core problem with file security. It's not just where you store files; it's how many copies you create every time you send one. Let's go through storage first, then transfer.

Secure storage: the four things that matter

Whether files live on a server in the office or in the cloud, secure storage comes down to four questions.

1. Is it encrypted?

Encryption at rest means the stored data is unreadable without the keys, so a stolen disk or a leaked backup isn't automatically a breach. Microsoft encrypts files in OneDrive and SharePoint at rest, with each file encrypted using its own AES-256 key. On laptops, BitLocker or FileVault does the same job for the local copy. An unencrypted USB stick does none of this, which is why it shouldn't hold anything sensitive.

2. Who can get in?

Encryption only protects data from people without access. Most real breaches use a legitimate account with a stolen password. That makes multi-factor authentication the single most important control on any file store, followed by access that matches the job. The bookkeeper doesn't need the HR folder. A departed staff member needs nothing at all.

3. Can you go back in time?

Ransomware doesn't steal files so much as overwrite them with encrypted versions. Version history is your first line of recovery. SharePoint keeps 500 major versions of each file by default, and OneDrive's "Restore your OneDrive" feature can roll an entire OneDrive back to a point in the previous 30 days. Deleted files sit in the recycle bins for up to 93 days.

4. Is there a real backup?

Version history and recycle bins aren't a backup. They live inside the same service, under the same admin accounts, with limited retention. If an attacker gets admin access, or a sync error quietly deletes files for months before anyone notices, you need a copy held somewhere separate. Our comparison of the best email and cloud backup options explains what to look for, and managed backup handles it for you.

Where files should live

For most small and mid-sized businesses on Microsoft 365, a sensible layout is:

• SharePoint (usually through Teams) for anything shared by a team or the whole business, with permissions set by group, not by individual.
• OneDrive for each person's working files and drafts, with Desktop and Documents backed up automatically.
• Line-of-business systems (practice management, accounting, CRM) for the records those systems are built to hold.

What doesn't belong in the plan: personal Dropbox or Google Drive accounts, files that live only on one laptop, and a USB drive in someone's desk drawer labelled "BACKUP". If you're still choosing a platform, our guide on choosing cloud storage for a small business compares the options, and keeping shared storage organised stops it becoming a digital junk drawer.

Secure transfer: stop sending copies, start sending access

Back to the contract with eight copies. The fix is a mental switch: instead of sending a copy of the file, send access to it.

When you share a OneDrive or SharePoint link, the file stays in one place. You control who can open it, you can see who has, and you can revoke access whenever you like. Better still, there's one version, so nobody's editing a stale copy.

Not all links are equal, though. Microsoft 365 offers several types:

• Specific people: only the named recipients can open it, after verifying their email address. Use this for anything confidential.
• People in your organisation: good for internal sharing.
• Anyone with the link: works like a key under the doormat. Whoever has the link can open it, including anyone it gets forwarded to. Admins can disable this type, limit it to view-only, or force it to expire after a set number of days, and in most businesses at least one of those is a good idea.

For extra-sensitive files, you can block downloads so the recipient can view but not save a copy. Microsoft Purview sensitivity labels go further, with encryption that travels with the file, so it stays protected even after it leaves your systems.

Large files, external parties and automated transfers

A few common situations need a specific answer:

• Files too big for email: use a SharePoint or OneDrive link rather than a free transfer website. Those sites are convenient, but your files then sit on a service you haven't vetted, under terms you haven't read. That's shadow IT in its purest form.
• Clients sending documents to you: a SharePoint file request or a client portal is better than asking clients to email tax returns or identity documents. It also keeps that material out of mailboxes, where it tends to sit forever.
• System-to-system transfers: payroll files to the bank, orders to a supplier, data to a logistics partner. These should use SFTP or a vendor API with encrypted connections and their own credentials, not a staff member's email account.
• Physical media: if a USB drive is genuinely necessary, use a hardware-encrypted one and record where it goes. Better yet, don't.

The part attackers love: payment details in transit

One file transfer deserves its own warning. Invoices and settlement documents with bank details are prime targets for business email compromise. An attacker inside a mailbox, or on a lookalike domain, intercepts a legitimate invoice and swaps the BSB and account number. It's the scam behind most conveyancing fraud. Always verify changed bank details by phone using a number you already have, never one supplied in the email. Our article on how conveyancing scams target law firms shows exactly how these play out.

The quick checklist

1. MFA on every account that can reach business files.
2. Encrypted laptops and phones; no sensitive data on unencrypted USB drives.
3. Team files in SharePoint with group-based permissions; personal working files in OneDrive.
4. Share links instead of attachments, with "specific people" links for anything confidential.
5. Restrict or expire "anyone" links at the admin level.
6. A separate backup of Microsoft 365, tested regularly.
7. Delete what you don't need. Australian Privacy Principle 11 requires you to destroy or de-identify personal information once it's no longer needed, and data you don't keep can't be stolen.

If personal information does leak, you may have obligations under the Notifiable Data Breaches scheme. The point of everything above is to make sure that's a rare event, and a small one when it happens.

Frequently asked questions

What is the most secure way to send files?

Share a link from a business cloud service such as OneDrive or SharePoint, restricted to specific people, with MFA on your account and an expiry date if appropriate. The file stays in one place and you can revoke access at any time, unlike an email attachment.

Is OneDrive secure for business files?

OneDrive for Business encrypts files at rest and in transit and supports MFA, sharing controls, version history and retention policies. Its security depends heavily on configuration, especially MFA, sharing link settings and access permissions, and it should still be backed up separately.

Are email attachments secure?

Email is usually encrypted in transit between major providers, but every attachment creates permanent copies in each sender's and recipient's mailbox and backups, outside your control. For sensitive files, a restricted sharing link is safer.

How do I send large files securely?

Upload them to OneDrive or SharePoint and share a link restricted to the recipients, rather than using a free file-transfer website. For regular automated transfers between systems, use SFTP or an API connection.

Local IT and cyber security support across NSW

Chewing IT runs managed IT and cyber security for small and mid-sized businesses from our Wyong and Hornsby offices, covering the Central Coast, Newcastle, Lake Macquarie and Hornsby.

Want your files stored and shared properly? Talk to us — we'll set up SharePoint, sharing controls and backup so your data stays where it should.