Security in Corporate Document Sharing

Quotes, contracts, payslips, invoices and ID copies. Most of the documents a business shares during a day have commercial or legal consequences if they fall into a third party's hands. Yet the sharing method is chosen out of habit in most places: attached to an email and sent.

Is putting a password on a PDF enough?

Putting a password on a document with 256-bit encryption prevents it being opened when the file reaches the wrong person, and that's serious protection. But it isn't enough on its own, because the weak link in the chain isn't the encryption but how the password is passed on. Sending the password in the same email as the document is the same as locking the door and leaving the key on top of the lock.

How the password should be passed on

The rule is simple: document and password must go through different channels. If the document goes by email, the password should be given by phone or sent by message. Two different messages on the same channel don't satisfy this condition; whoever accesses the mailbox sees both.

The password itself must not be guessable either. Sequences like the company name, the year, the customer's name or 1234 give no protection. Generating a separate, random password for each document is the healthiest approach.

What to use instead of an email attachment

An email attachment is a bad carrier for three reasons: it leaves your control as it's forwarded, it stays on servers indefinitely and it hits size limits.

The alternative is sharing a time-limited link whose access can be controlled. That way you can see who opened the document and when, and revoke access if needed. There's no way to take back an email attachment that's been sent; closing access to a shared link takes seconds.

Which document deserves which protection

Applying the same level of protection to every document is unsustainable in practice. A simple distinction does the job:

Classifying once and sharing it with the team is more reliable than deciding anew every time.

The real value of permission restrictions

Print, copy and edit restrictions can be applied to PDFs. These differ from the open password: the document is already open; only certain actions are blocked.

Be realistic — these restrictions are easily bypassed in most readers and should not be counted as a security measure on their own. Their function is to keep a well-meaning user from an accidental action; they don't stop a malicious one.

Five common mistakes

1. Sending the password in the same email as the document. The most common and most easily prevented mistake.
2. Using the same password for all documents. Once it leaks, the whole archive opens.
3. Not cleaning up old shares. If the link to a quote from two years ago is still open, that document is still out there.
4. Sharing from a personal cloud account. When the employee leaves, company documents stay in their account.
5. Not checking the contents before sharing a document. Another customer's details may have been left in the quote file; one of the most common forms of data leak.

Setting up a routine within the team

Document security is achieved not by individual care but by routine. Three items are enough for most businesses:

• Define a single sharing method and have everyone use it. When some use email, some personal cloud and some a chat app, nobody knows where any document is.
• Grant access by role. The designer doesn't need access to accounting documents.
• Do a clean-up once a year. Close share links left open, delete unnecessary archives.

There's a legal side too

When documents containing personal data (ID, payslips, medical reports) are shared, the responsibility stays with the sender. To whom, for what purpose and for how long these documents were sent must be recorded.

Also, deleting documents whose retention period has expired is not a choice but an obligation. A ten-year personnel archive kept "just in case" multiplies the damage in a breach.

A short check before sending

Before sending a document ask four questions: is it going to the right person, is there someone else's information left inside, does it need protecting, will the password go through a different channel. These four questions take thirty seconds and cut off most sharing-related problems at the source.

The difference between encryption types

There are two kinds of password in PDFs, and they get confused. The open password is needed to view the document; without it the file doesn't open at all. The permissions password doesn't prevent opening the document; it only restricts actions like printing or copying.

The one that provides real protection is the open password. The encryption standard used also matters: the old 40- and 128-bit methods are considered weak today; 256-bit AES is the current standard. When choosing a tool, look at which standard it applies.

This point also needs saying clearly: however strong the encryption, if the password is short and guessable there is no protection. A password like Company2026 makes 256-bit encryption meaningless.

There are rules for the receiving side too

Security is not only the sender's responsibility. The documents you receive also accumulate somewhere and usually stay in the mailbox without a second thought.

Three habits work for incoming sensitive documents: deleting the email attachment after downloading the document, not letting them pile up in the downloads folder, and removing the document from the archive when the job ends. An ID copy sent by a subcontractor shouldn't be sitting on your computer two years after the job finished.

A practical flow for sharing contracts and quotes

Tying a frequently repeated job to a routine is safer than deciding every time. The flow that works for quotes and contracts is this:

1. Prepare the document; check that no other customer's information is left inside.
2. Generate a random password and apply it to the document.
3. Send the document; pass on the password by phone or message.
4. After the other side approves, store the signed version with the same routine.
5. When the job closes, close the share link if there is one.

These five steps look long the first time; by the third use they become habit and take thirty seconds.

Don't forget physical documents either

Keeping the digital side tight while leaving the printout on the desk is a common contradiction. Printouts not collected from the shared printer, contract copies left in the meeting room and payslips thrown away without shredding are the easiest documents to get hold of.

Two simple measures are enough: using the printer's hold feature when printing sensitive documents (the printout is only produced when you go to the printer and confirm) and keeping a shredder for disposal.

Cloud account or your own server

Using a corporate cloud service for document sharing is the right choice for most businesses: access logs, time-limited links and permission management come ready. Setting up a solution on your own server makes sense only when regulation requires the data to reside in a specific place.

Whichever you choose, the deciding factor is the same: who owns the accounts and whether access is closed when an employee leaves. A sharing routine run from a personal account is riskier than even the most expensive cloud subscription.

To add a password to your PDF documents or remove one you know, you can use the PDF Encryption tool; the files are deleted from the server after processing.