TL;DR:

  • The biggest file sharing security risk for small businesses isn’t hackers — it’s “anyone with the link” settings and sharing with people who’ve left the company
  • All three major platforms (OneDrive, Google Drive, Dropbox) have good security when properly configured; the defaults are often too permissive
  • Enable MFA, audit shared links quarterly, and set expiry dates on external shares — these three habits cover most of the risk

Every small business shares files. Quotes go to clients. Payroll spreadsheets go to accountants. Contracts go to solicitors. The question isn’t whether to use cloud file sharing — it’s whether you’re sharing securely or accidentally exposing things that shouldn’t leave the business.

The Most Common File Sharing Security Mistakes

Before comparing platforms, it’s worth naming what actually goes wrong:

1. Links set to “anyone with the link”: When you create a sharing link in most platforms, the default is often a link that works for anyone who has it — no login required. These links get forwarded, posted in public Slack channels, or indexed by search engines in rare cases. They never expire unless you set an expiry.

2. Sharing with ex-employees: When someone leaves your business, their account access should be removed immediately. If you shared folders or files directly with their work or personal email, those shares persist until manually removed.

3. No MFA on the admin account: All the platform security settings in the world don’t matter if the admin account is compromised via a phished password. MFA on every account, especially admin accounts, is the most important single control.

4. No review of what’s been shared: Files shared “temporarily” for a client project three years ago are still shared. Most businesses have no idea what their cloud storage is currently sharing with whom.

Microsoft OneDrive (Microsoft 365)

Best for: Businesses already using Microsoft 365 (Outlook, Teams, Word/Excel). OneDrive integrates deeply with the Microsoft ecosystem.

Security controls to configure:

Sharing settings (accessed by your Microsoft 365 admin at admin.microsoft.com → SharePoint admin centre → Policies → Sharing):

  • Change “Anyone” (unauthenticated) links to off, or restrict to requiring expiry dates (maximum 30 days is a sensible policy)
  • Set the default share type to “Specific people” rather than “Anyone in your organisation” for sensitive folders
  • Require a verification code for external “Anyone” links (this requires recipients to verify their email before accessing)

Access reviews:

  • Use Microsoft Entra ID’s Access Reviews (available in Business Premium) to automatically ask users and managers to confirm whether shared access is still needed
  • Alternatively, run a manual review quarterly: go to SharePoint admin → Reports → Sharing to see all external shares

Sensitivity labels (Microsoft 365 Business Premium): Apply labels like “Confidential” to folders containing financial or HR data. Labels can restrict who can share those files and prevent download to unmanaged devices.

MFA: Enable via Microsoft Entra ID (formerly Azure AD) Conditional Access. Require MFA for all users, especially for access from outside your office network.

Google Drive (Google Workspace)

Best for: Businesses using Google Workspace (Gmail, Docs, Sheets). Very strong collaboration tools; security requires intentional configuration.

Security controls to configure:

Sharing settings (Google Admin console → Apps → Google Workspace → Drive → Sharing settings):

  • Disable “Anyone with the link” sharing for files containing sensitive data. You can restrict this to your domain only, so external parties must be explicitly added
  • Require that external sharing goes through your admin for approval, or limit it to specific trusted domains
  • Set link expiry for viewer access (Google Workspace Business Plus and above): links to non-Google accounts can be set to expire

Shared drive vs My Drive: Use Shared Drives (formerly Team Drives) for business files rather than individual My Drive folders. Shared Drive files are owned by the team, not the individual — when an employee leaves, their files stay accessible. My Drive files belonging to a departing employee require admin action to preserve.

Reporting: Google Workspace Admin console → Reports → Audit → Drive shows every sharing event. Filter for “Share” actions to see what’s been externally shared.

MFA: Google Workspace supports 2-Step Verification (Google Authenticator, hardware keys). Enable and enforce it for all users via Admin → Security → 2-Step Verification → Enforcement.

Dropbox Business

Best for: Teams that work heavily with external parties (clients, freelancers, agencies) and need reliable external sharing. Dropbox has historically had the most polished external collaboration features.

Security controls to configure:

Shared link settings (Dropbox Business admin console → Content → Shared link settings):

  • Set default access to “Team only” or “Specific people” rather than “Public”
  • Enable password protection and expiry dates for all external links by default
  • Restrict team members from creating public links without admin approval

Admin visibility: Dropbox Business admins can view all team member sharing activity. Regular audits of the “Activity” report in the admin console identify overshared content.

Paper Trail (Dropbox Business Plus): Dropbox Paper documents have their own sharing settings; ensure they follow the same controls as Dropbox files.

MFA: Available for all Dropbox Business accounts. Enforce it via admin settings.

Tresorit (For High-Sensitivity Content)

For businesses handling legally sensitive content — law firms, accountants, healthcare practices, financial advisers — Tresorit is worth knowing about. Unlike the three above, Tresorit uses zero-knowledge end-to-end encryption: not even Tresorit can read your files. Pricing is higher, and the collaboration experience is less seamless, but if you’re sharing confidential legal documents or patient records, the additional protection is appropriate. Under UK GDPR, you’re responsible for the security of data you process; for regulated sectors, “zero-knowledge” storage is easier to defend to the ICO.

The Three Habits That Cover Most Risk

Regardless of which platform you use:

1. Enable MFA for everyone, starting today: This is the single highest-impact security action. Use your platform’s admin console to enforce it. Takes 30 minutes to set up.

2. Quarterly sharing audit: Schedule a recurring calendar reminder every three months. In each platform’s admin console, pull a report of external shares and review: Are these still needed? Has the recipient left the company they’re from? Can you set expiry dates on anything that’s still open?

3. Offboarding checklist for leavers: When someone leaves, their access to cloud storage must be removed on their last day. Create a checklist: (1) Disable their account, (2) Transfer ownership of their files to their manager, (3) Revoke any shared links they created, (4) Remove their personal email from any shares they were added to personally. This is the most common source of ongoing data exposure in small businesses — former employees or contractors retaining access months or years after departure.

The good news: all three major platforms have the security controls you need. The gap is almost always configuration and habit, not capability.