Blog

Secure File Sharing for Professional Services

Image: Maria Mileta via Pexels

If you work in a law firm, health practice, or any organisation that handles sensitive client information, chances are you send files by email every day. It’s fast, familiar, and convenient — but email attachments have some real limitations when it comes to security and compliance, and it’s worth understanding why.

The Problem with Email Attachments

Email was never designed with confidentiality in mind. When you attach a document and hit send, a few things happen that should give any professional services organisation pause:

• No control after sending. Once an attachment leaves your outbox, you have no way to revoke access, update the document, or know who else has forwarded it on.
• Copies everywhere. The file sits in your sent folder, the recipient’s inbox, potentially their email server, and any backup systems along the way — often unencrypted at rest.
• No audit trail. You can’t tell whether the document was opened, by whom, or when.
• Size and deliverability issues. Large files get blocked, bounce, or end up in spam — so people resort to consumer tools like personal Dropbox accounts or WeTransfer, which introduce their own risks.

For organisations bound by the Privacy Act 2020, these aren’t just inconveniences — they’re potential compliance exposures. The Office of the Privacy Commissioner has been clear that agencies must take reasonable steps to keep personal information secure, and that includes how it’s transmitted.

What to Use Instead

The good news is that there are straightforward alternatives that fit naturally into everyday workflows.

Microsoft OneDrive and SharePoint (part of Microsoft 365) let you share a link to a document rather than attaching the file itself. The document lives in one place, you control who can access it, and you can revoke that access at any time. It integrates with Outlook, so the experience for staff barely changes — but the security posture improves significantly. You can also see when a file was opened and by whom, which is genuinely useful for client work.

SmartShare is a New Zealand-developed secure file sharing platform that’s particularly well suited to professional services. It provides encrypted, auditable file transfers with a clean client-facing experience — useful when you’re sharing documents with people outside your organisation who may not have a Microsoft 365 account. It’s designed with compliance in mind and has been adopted by a number of New Zealand law firms and health providers for exactly that reason.

A Few Practical Tips

• Set link expiry dates when sharing externally — don’t leave access open indefinitely.
• Require recipients to authenticate before downloading, where possible.
• Avoid sharing sensitive documents via personal email accounts or consumer cloud services.
• Make sure your file sharing tools are covered by your organisation’s acceptable use policy.

The NCSC’s guidance for organisations reinforces that controlling access to sensitive information — including how it’s shared — is a foundational part of good security practice.

Switching away from attachments doesn’t require a big project or a difficult conversation with staff. Often it’s a matter of a small change in habit and knowing which tools are already available to you. If you’d like help reviewing how your team shares files or understanding what’s already included in your Microsoft 365 licence, our team is always happy to help.

Simon Falconer
Director, Resolve Technology
When he’s not finding a reason to buy the latest gadget, Simon is probably setting it up, breaking it, and fixing it again — all before breakfast.