File sharing permissions define who can access company files and, separately, what they can do with them: read, edit, delete or share. In a well-designed setup, permissions are tied to roles and departments rather than granted person by person, risky actions are open only to those who need them, and a leaver's access closes in a single step.
"Let everyone see the shared folder" invites both data leaks and accidental deletion.
What really happens in a shared folder
Most companies' file structure starts with one shared folder. At first there are five people and everyone can see everything, which is practical. As the company grows, payroll spreadsheets, customer contracts, quoted prices, personnel files and tender documents land in the same folder, but the permission structure never changes. If your files still sit on an office server, the natural moment to rebuild permissions from scratch is when replacing the on-premise file server.
The result looks like this:
- Everyone sees everything. The warehouse supervisor can open the salary spreadsheet; the intern can read customer contracts.
- Everyone can delete everything. Anyone with read access can also delete and move files.
- Permissions pile up. An employee who changes department keeps access to their old department's folders.
- External sharing is uncontrolled. A link to a file is sent to a customer and stays valid for months.
- Leavers are forgotten. Their account, or a copy of the folder synced to their own device, lingers for months.
These problems rarely come from bad intent; they arise because nobody thought about it. The outcome is the same either way: sensitive data is open to far more people than it should be. The wider framework behind a permission matrix is set out in our document management system guide.
The cost of uncontrolled permissions
Permission problems stay invisible until something happens. When it does, the answer to "who could access this file?" is usually "everyone".
According to the Microsoft Digital Defense Report 2025, attackers sought to steal data in 80% of the incidents Microsoft's security teams investigated. (Microsoft Digital Defense Report 2025)
When an attacker takes over an employee's account, they see everything that account can see. In Sophos' State of Identity Security 2026 survey, 71% of organisations said they had suffered at least one identity-related breach in the past year. A compromised account is not an exception, then; the real question is how much data that account can reach. The principle of least privilege exists to limit exactly that damage.
Third parties add another layer. According to the Verizon 2026 Data Breach Investigations Report, breaches involving a third party rose 60% to 48% of the total. Sharing links opened for customers, suppliers or an external accountant are the file-level side of those third-party relationships. The risk is sharper in firms that hold client or taxpayer files; our guides to law firm document management and accounting firm document management cover sector-specific permission set-ups.
For organisations operating in Türkiye there is also a legal dimension. KVKK, Türkiye's personal data protection law (Law No. 6698, broadly comparable to the GDPR), requires data controllers to take technical and administrative measures to prevent unlawful access to personal data. A shared folder in which payroll or personnel files are open to every employee is the clearest example of those measures being missing. The full set of measures is covered in KVKK compliance steps, and the same principle applied to mailboxes in our email archiving compliance guide.
Break permissions down: "access" is not one right
The most common mistake is reducing permissions to two options, "has access" or "doesn't". Yet the actions possible on a file carry very different risks:
| Permission | What it allows | Risk |
|---|---|---|
| Read | Open and download the file | Data leak |
| Write | Upload new files | Low to medium |
| Edit | Change an existing file | Content corruption |
| Delete | Remove the file | Data loss |
| Create folder | Change the structure | Disorder |
| History | See earlier versions | Sensitive details such as old prices or drafts |
With this separation you can write rules that match real work, such as "can read the finance folder but cannot delete" or "can edit quotes but cannot see earlier prices". The logic mirrors physical access: not everyone may enter every part of a factory, and not everyone should open every folder; see the comparison in zone-based access in factories.
Setting file sharing permissions: six steps to a permission matrix
- Classify files by sensitivity. General (procedures, templates), departmental (quotes, purchasing), confidential (payroll, personnel files, contracts). The class is the starting point for permissions.
- Structure folders by department and project. Permissions are granted on folders; if the folder structure does not reflect the organisation, neither can the permissions.
- Tie permissions to departments, not people. A new starter added to a department should automatically get the right access; someone who changes department should automatically lose the old one.
- Start with least privilege. New assignments come with read on, and delete and history off. Extra rights are requested with a reason and approved by the folder owner.
- Put a time limit on external sharing. A download link sent to a customer or supplier should not be permanent; ideally it expires within minutes or hours.
- Review every quarter. Each folder owner asks "does everyone on this list still need this access?", and leavers and movers are removed.
Example: a matrix for a 40-person manufacturer
| Folder | Management | Finance | Sales | Production | Intern |
|---|---|---|---|---|---|
| Procedures and templates | Read, edit | Read | Read | Read | Read |
| Quotes | Read, history | Read | Read, write, edit | — | Read |
| Invoices | Read | Full | Read | — | — |
| Payroll and personnel | Read | Read, write | — | — | — |
| Technical drawings | Read | — | Read | Read, write, edit, history | — |
Treat this as an example and adapt it to your own structure. What matters is that delete rights exist only where needed, and in few hands. Who should reach the bid folder during a tender, and with which rights, is covered separately in tender email security.
The overlooked sharing channel: email attachments
However well you set folder permissions, a file leaves that structure the moment it is sent as an attachment. The payroll spreadsheet may be well protected in the finance folder, but once it goes to three colleagues with a "could you check this?" note, it lives on in three separate mailboxes as uncontrolled, unversioned copies. Add one more rule to your policy: internal sharing points people to where the file lives rather than attaching it. Incoming attachments are saved to the relevant folder before anyone works on them, so the file falls under that folder's rules and access stays visible. Whether your email service supports permission-controlled links instead of attachments is one of the criteria to check when you choose a business email service.
If you still have to send a document as an attachment, our business email encryption guide compares which layer of encryption is enough.
In project-based practices the permission matrix is also split by discipline: the structural team can read architectural sheets but not change them. A worked example is in our architecture firm file management guide.
How we approach this at Digital Bridge
Permissions look like a technical setting, but they are really an organisational decision. We work with organisations in this order:
- Current state review: We map access lists on shared folders, leavers' accounts and externally shared links, and prioritise the risks. Access gaps are reported as part of our cyber security consultancy.
- Matrix design: With department heads, we prepare a permission matrix like the one above. For folders holding personal data, our data protection compliance consultancy team reviews the access rules.
- Implementation: We put the matrix into practice on our own product Smart360 or on your existing infrastructure. If permissions need to follow department data in your HR system, we also plan the system integrations.
- Written proposal: Scope, phases and fees are set out in writing; we do not push off-the-shelf packages.
How permissions work in SmartFiles and Smart360
Smart360 is our own product family that brings SmartFiles (business document management), SmartMail (business email), the SmartOperator AI website agent and the SmartPass access control product together under one panel and one identity, SmartID. Here is how the principles above map onto it:
- Eight independent permissions, one matrix. In SmartFiles, read, write, edit, delete, create folder, AI, history and notes are independent of each other and granted to a person or a department from a single matrix.
- Access follows the department. When an employee changes department in Smart360, their access changes across all products; a leaver's entire access is closed in one action. Our single sign-on guide explains the single-identity model behind this.
- Short-lived links. SmartFiles download and preview links expire within minutes, so even an intercepted link is of little use for long.
- Session control. Sessions are listed with device details and can be ended remotely; changing a password ends every session.
- Separation between companies. Even when you manage several companies from one account, each organisation's data sits in its own database and none can see another's.
- AI is a permission too. AI features are a separate right, and administrators can switch them off entirely. When someone asks a document a question, the AI answers only from files that person is allowed to see, so AI does not become a way around the permission matrix.
A concrete scenario: a salesperson moves to the finance team. The administrator changes their department in the Smart360 panel; at that moment they lose access to the "Quotes" folder in SmartFiles and the sales@ shared mailbox in SmartMail, and gain access to the finance folders and the accounts@ mailbox. Nobody walks through folder lists one by one, and no old access is forgotten.
Next step
This week, pick your most sensitive folder (usually payroll or contracts) and pull its access list. If there is a name you did not expect, it is time for a permission matrix. For who should see earlier versions, read our document version control guide; for leavers, see our guide to email access when employees leave. The other articles on the topic are gathered in our Business Email & Documents guide. If you would like to work with us, from an access review to matrix design, get in touch via our contact page.