Cloud Storage & File Sharing Security
Cloud services make it easy to share plans, photos, bids and forms across a crew and keep files safe if a phone is lost. They also make it easy to expose private files to the wrong people or lose access to everything if an account is hacked.
- Everyone
- Small Businesses
- Crews
Protect the account
- Use a strong, unique password from a password manager. See Password Managers
- Turn on two-step verification, preferably with an authenticator app or security key. See Two-Factor Authentication
- Review signed-in devices and connected apps, and remove ones you do not use or recognize
- Set up recovery options with a current email and phone number
- Use separate accounts for work and personal files where you can
- Never share your password. Give people access to the files instead
Sharing safely
- Share with specific people by email rather than public links. "Anyone with the link" means anyone who gets the link can open it, including by forwarding.
- Choose the lowest permission needed: view only, comment or edit.
- Set expiration dates and passwords on links when the service supports it.
- Check who has access to shared folders every few months, and remove people who have left the job or company.
- Avoid sharing sensitive documents such as IDs, Social Security numbers, bank details and contracts through public links or unsecured messages. Use secure options.
- Double-check the recipient and file before you send.
Scams and traps
- Fake share notifications: emails that look like they came from a cloud service asking you to sign in to view a file. Go to the service directly rather than clicking the link. See Phishing Emails.
- Be wary of unexpected files, QR codes and links to download. Malicious files can spread through shared folders. See Malware & Antivirus and Ransomware.
- Be careful with free storage from unknown sites.
Backups and privacy
- Cloud sync is not always a backup; deleting or encrypting a file by mistake or ransomware can sync the damage. Keep another backup. See Backups.
- For highly sensitive data, consider encrypting files before upload.
- Read how long the service keeps deleted files and how to restore.
- Follow company policies about where work files may be stored. See Remote Work Security.
Standards & references
Last updated: