Secure Collaborative Document Workspace

A shared folder link, once forwarded, keeps working for anyone who has it — there's no record of who that ended up being, and no way to revoke access for one person without breaking it for everyone.

Email attachments are worse in a different way: a copy lives in every inbox it passed through, plus every backup and sent-items folder along the chain. Deleting the original changes nothing about those copies.

Neither failure looks like an incident. Access just accumulates quietly over time, until a departed employee, a former subcontractor, or an old forwarded link is a live way into a client's documents nobody remembers exists.

Folder-level permissions ask "who can open this drive", which is the wrong question. The right one is "who should see this specific client's file" — which changes case by case and person by person, not per folder.

Role-based access answers that: a reviewer sees only the cases assigned to them, a client sees only their own request, and a manager sees across the team without every reviewer seeing across the manager's whole scope.

Review access on a schedule, not just when someone leaves. Access that made sense when a case was assigned rarely gets revisited once the case closes, which is exactly how stale access accumulates.

A shared password is either memorable (and guessable) or unmemorable (and gets written down somewhere insecure). Either way, it doesn't expire on its own and doesn't identify who used it.

A magic link tied to one person's email and a limited validity window solves both problems: it identifies the recipient, and it stops working on its own instead of requiring someone to remember to disable it.

This matters most for external contributors — clients, subcontractors, one-off reviewers — who need access for the duration of one case and no longer. A standing account for a one-time contributor is access debt from day one.

Encryption in transit and at rest is table stakes, not a differentiator — ask about it, but don't stop there. The more useful question is where the data physically sits and under which jurisdiction's rules.

Ask for the full subprocessor list, not just the primary vendor's claim. Email delivery, backups, and logging tools are often separate services, and a workspace can be EU-hosted on paper while one of those subprocessors isn't.

Ask what happens to a document after deletion — whether it's removed from backups on a schedule or kept indefinitely. "Deleted" should have a defined meaning, not be a UI action that only hides the file from view.

Log access events — who viewed, downloaded, or approved a document, and when — separately from the documents themselves. That log is what lets you answer 'who saw this' without reopening the file in question.

Don't over-collect in the name of security. Logging full document contents in an activity feed, for instance, just duplicates sensitive data in a second place that also needs protecting.

Keep the log itself access-controlled too. A detailed record of who accessed what is sensitive in its own right, and shouldn't be more open than the documents it's tracking.