How do you limit and track what an insider can do with a shared file? Put the rules on the file itself. You decide who can open it, what they can do with it, when, and from where. SafeSuite checks that policy each time someone tries to open the file. The owner can change or end access after sending, and a history log records every attempt, successful or not.
Most insider incidents are accidents, but a meaningful share are deliberate, and those are the hardest to spot. The 2026 Cost of Insider Risks report from the Ponemon Institute and DTEX attributes 27% of insider incidents to malicious insiders and found that incidents take 67 days on average to contain. A control that only works at the moment of sending leaves a long window in which nobody can see or change who has access.
Why insider access is hard to limit
An insider already has a legitimate way in: a login, a role and a reason to be working with the file. That makes the usual signals unreliable. Opening a file looks the same whether the person is doing their job or preparing to leave with it.
Two things make it harder. First, permissions describe a role at one moment. Folder and mailbox permissions show who could reach a file when they were set, and they do not adjust when someone is reassigned or gives notice. Second, visibility arrives late. Most tools show activity inside your own systems and say little about what happens to a file you sent to a partner or a contractor.
Time is what makes the gap expensive. The Ponemon and DTEX report found that incidents contained in under 30 days cost an average of $14.2 million, against $21.9 million for those that ran past 90 days. The sooner you can see an attempt and end access, the less an incident costs.
What you can set on each file
When you protect a file with SafeSuite, you set one policy for it, and the policy has four controls:
- Who can open it: specific named people or organizations, not anyone who happens to receive the file. A finance report can open for the finance team and no one else.
- What they can do with it: you decide what a person can do once they are in, as well as whether they can open it at all.
- When it can be opened: expire access on a date, or limit it to a defined window such as the length of a project.
- Where it can be opened from: restrict access by country or region, which suits roles tied to one location.
Because the policy is checked each time someone tries to open the file, these controls apply to every attempt, not only the first. Forwarding a protected file does not give a new person access. Whoever receives it still has to meet the policy.
End access when a role changes, and see every attempt
People move teams, give notice or become a concern. With SafeSuite you do not have to wait for a file to come back or ask anyone to delete it. You can change the policy or end access from your account, whether the file was shared an hour ago or months ago. A person whose access has ended does not receive the one-time code needed to open it.
The history log shows each access attempt on a protected file, successful or not. Failed attempts are often the most useful ones, because they show someone trying to open a file they are no longer meant to see. Since the log and the controls sit in the same place, the step from noticing to acting is short, which matters given what the Ponemon and DTEX figures show about the cost of waiting.
Recipients outside your company do not need a Keyavi account. They verify with a one-time code when they try to open the file.
Example scenario: a regional sales lead gives notice
A regional sales lead gives notice. Over the past year, customer proposals and account plans were shared with her, and she opened several of them in her final week. Her manager is not sure what to make of it.
Because each file carries its own policy, the security team does not have to guess. They end her access to those files from their SafeSuite account, which takes effect the next time she tries to open one. The history log shows every attempt on those files, including any made after access ended, and who made them. The team has a dated record to review, and the files stay available to everyone else who is meant to have them.
SafeSuite Lite or full SafeSuite?
SafeSuite Lite protects email sent from Outlook or Gmail, including the message, its attachments, or both, with the same four controls and history log. Full SafeSuite covers the rest of how files are shared and adds the desktop app, Intelligent Directory, and admin review of the history log. Lite is the simpler place to start, because email is where outside sharing most often begins. Teams move to full SafeSuite when they want to review access across the organization.
Frequently asked questions
Can I limit access to a file after I have already sent it?
Yes. From your SafeSuite account you can change the policy on a protected file or end access, whether the file was sent an hour ago or months ago.
Does the history log show failed attempts?
Yes. It shows every access attempt on a protected file, whether it succeeded or failed.
Does forwarding a protected file give someone new access?
No. Whoever receives it still has to meet the policy set on the file.
Related reading
See how SafeSuite lets you limit and track access to the files you share.
See it in action and get your specific questions answered.