Sharing files and cloud storage

Achieng, a field researcher at a health rights group in Kisumu, needed to send her interview notes to a partner clinic, so she shared the folder the quickest way she knew: a link anyone could open. The notes held people’s names and health details. Weeks later, a colleague spotted the link in a large WhatsApp group. Achieng switched it off within the hour, then spent the afternoon working out who might have seen it.

Where your files live

Most teams keep files in two kinds of place: a cloud drive, such as Google Drive or Microsoft OneDrive, and their own laptops, phones, USB sticks and hard drives. Cloud storage means your files sit on a company’s computers, and you reach them over the internet (Security in a Box).

Files spread across laptops, drives and an old office server are hard to protect all at once. For most small teams, one well-run cloud space is easier (NDI):

In 99 percent of situations, the easiest and most secure option is to keep data stored in trusted cloud storage services.

Cybersecurity Handbook for Civil Society Organizations, NDI

It helps with everyday mishaps too: if a laptop is lost or has to be wiped, the files are still there to sync to a new one. NDI advises against running your own server. In 2021, attackers broke into self-hosted Microsoft Exchange email servers around the world, and many organisations couldn’t apply the fix quickly (NDI).

The trade-off is that the company can read files that aren’t encrypted, and so can anyone who gets into the account. A company can also be made to hand files over by a legal demand (Security in a Box; Access Now; NDI). And a cloud drive still needs a backup of its own (Backups).

Choosing a service

Ask these questions before you choose a service, or about the one you already use (NDI; Security in a Box; Access Now):

• Who runs it, and do they sell or share your data?
• Does it have security staff, two-factor authentication and sharing settings you control?
• Can the company read your files, or are they end-to-end encrypted, so only you and the people you share with can?
• Where is the company registered, and where are its servers?

You can choose one of three setups (Security in a Box; Access Now):

• Google Workspace or Microsoft 365, which many teams already use for email. Sharing and working together are easy, and the companies have large security teams, but they can read what isn’t encrypted.
• An end-to-end encrypted service, such as Proton Drive, Tresorit or Nextcloud with encryption turned on. The company can’t read your files, but there are fewer tools for working together, and only you hold the key, so keep the password in your password manager.
• Your current service, with the most sensitive folders encrypted first. If moving everything is too much, encrypt those folders, or move only the people who handle sensitive files to an encrypted service (Access Now).

Whose laws your data falls under

Data sovereignty means whose laws your data falls under. Two things decide it: the country where the company is registered, and the countries where its servers are (Security in a Box). If people who want to harm your work can use those laws to make the company hand over your files, use a different service for anything sensitive (NDI). Keeping files on your own server doesn’t avoid the question: your own government can make the same demand of you (NDI).

Data protection laws add duties of their own when you hold personal data. Kenya’s, Uganda’s and South Africa’s laws, for example, let personal data go abroad only under conditions, such as adequate protection where it’s going or the person’s consent. Data Protection Africa sets out the law in all 55 African countries, 43 of which had a data protection law in January 2026; elsewhere, look up your own country’s law. Some providers let you choose the region your files are kept in, and a lawyer can tell you whether you need to (NDI).

Sharing safely

A sharing link opens a file or folder for whoever has it. Set to “anyone with the link”, it works like a key anyone can copy: whoever it’s forwarded to can open the file, inside your organisation or not (Access Now; SIIRF).

• Share with named people for anything sensitive, not “anyone with the link” (Access Now).
• Give each folder only the people who need it, and set folders up that way from the start (NDI). Who has access helps you decide who.
• Share from the organisation’s accounts, not personal ones (NDI), so you can still remove access when someone leaves.
• Set an end date when someone needs a file only for a while, where your service allows it (Access Now).
• Keep sensitive files out of email attachments and off USB sticks where you can. Sticks get lost and pass on harmful software, and attachments make phishing easier (NDI).
• For a one-off large file, use a service that encrypts it and keeps it only for a short time: share.riseup.net for files up to 50 MB, downloaded within 12 hours; upload.disroot.org for up to 2 GB, within 30 days; send.tresorit.com for up to 5 GB, within seven days (Security in a Box). Send the link through an end-to-end encrypted chat: a file is only as safe as the way its link travels (NDI).
• Agree with partners what you’ll share, how and for how long, and keep a note of what you shared and why (SIIRF).
• Take out hidden details, such as where a photo was taken or who wrote a document, before files go outside: Deleting data safely shows how.

Encryption you can use

Files on laptops, phones, USB sticks and hard drives need encrypting too: whoever gets hold of an unencrypted device can read what’s on it (Security in a Box). Phones and laptops explains encryption and how to turn it on for your devices.

• USB sticks and external drives get lost and taken more easily than laptops, so encrypt them with a strong password. BitLocker, on Pro and business versions of Windows, and Disk Utility on a Mac can do it, though the drive then opens only on that system; VeraCrypt works on Windows, Mac and Linux (Security in a Box).
• Sensitive folders in a cloud drive: Cryptomator encrypts them before they upload, on computers and phones, so the company can’t read them (Security in a Box). Share the password for a shared Cryptomator folder through a separate end-to-end encrypted channel (Access Now).
• Check the law first. In some countries encryption is illegal or draws suspicion, so find out how it’s treated where you work and travel (Security in a Box).

Bringing your team with you

1. Choose one place and start small. Agree where the organisation’s files will live, move your own and the director’s first, then one team or project at a time (NDI).
2. Set up folders and permissions together in a short session, and switch off “anyone with the link” for sensitive folders (NDI).
3. Write a short “how we share” note: named people only for sensitive files, what gets encrypted and how partners receive files. Add it to your security policies.
4. Help one to one with moving old files off laptops and USB sticks, and with encrypting the drives that stay.
5. Keep a chat for questions. “Can I send this to a partner?” should be easy to ask before anything goes out.
6. When someone leaves, move the files they own into the organisation’s hands before their account is closed, since deleting an account can delete its files (Access Now). Then take them off shared folders (Who has access).
7. Check sharing every three months. Look for files open to anyone with the link and people who no longer need access, and remove them (NDI; Checklists and audits).

If it’s already happened

If a file reaches the wrong person, or a folder turns out to be open to anyone with the link, SIIRF’s Data Breaches playbook sets the order:

1. Stop the leak. Switch off the link, remove anyone who shouldn’t have access and secure the accounts involved.
2. Work out what was exposed, whose details they were and how many people are affected.
3. Put people’s safety first. Tell those affected in a way that keeps them safe, and explain what they can do.
4. Check whether you must report it. Many data protection laws require serious breaches to be reported, often within 72 hours.

Note each step and when you took it in your incident log, as your incident response plan describes. The playbook covers the rest of the response.

Be wary of a “document shared with you” message you weren’t expecting: it may lead to a fake sign-in page. Phishing shows how to check, and Social engineering covers people who pose as partners to ask for files.

Teach it to your team

This takes about 20 minutes, with laptops open.

• Prepare: make sure everyone can sign in to the organisation’s cloud drive, and find where it shows who a file is shared with.
• Exercise: each person goes through the files and folders they own, looks for anything open to “anyone with the link” or shared with someone who no longer needs it, and fixes it. Count the fixes together at the end.
• Three questions: Who can open a file shared with “anyone with the link”? How should a large, sensitive file reach a partner? What’s the first thing to do if a link reaches the wrong person?
• Afterwards: help one to one with anything people couldn’t fix, and keep answering questions in the team chat.