The control you keep after sharing a file with someone outside your company depends on where those controls live. If they live in a channel, such as an email system, a drive, or a data room, they apply while the file stays in that channel. If they live on the file itself, they apply every time someone tries to open it. That one distinction explains most of what feels unpredictable about outside sharing.
Controls that live in the channel
Most sharing tools work by controlling access to the place where a file sits. Email delivers the file and then steps aside. A shared-drive link ties access to the drive’s own permissions. A virtual data room builds a controlled space with permissions and activity tracking inside it. Each of these can be the right choice for the job. What they have in common is that their controls are properties of the channel, so they’re strongest while the file remains in it.
Controls that live on the file
The alternative is to attach the rules to the file itself. This is the idea behind policy-based data protection: a file carries its own policy covering four things, who can open it, what they can do with it, when, and from where. Because the policy belongs to the file, it’s checked each time someone tries to open it, whichever channel the file took to reach them, and you can change it after you’ve sent the file.
The four controls, in plain terms
- Who: Which specific people or organizations can open the file.
- What: What those people are allowed to do once they’re in.
- When: The dates or window during which the file can be opened.
- Where: The countries or regions the file can be opened from.
How the two approaches compare
| How it’s shared | Where the controls live | What you can see afterward | Can you change access after you share? |
|---|---|---|---|
| Email attachment | Nowhere, once it’s delivered | Delivery, and not much else | No |
| Shared-drive link | In the drive’s sharing settings | Who has access now, depending on the platform | Yes, by changing the link’s sharing settings but only while it’s within the drive |
| Data room | Inside the room | Activity inside the room | Yes, only while it’s inside the room |
| Protected file (SafeSuite) | On the file itself | Every access attempt, in the history log | Yes, change the policy or end access on the file itself |
The last column matters as much as the controls themselves. A control you can set but never observe is hard to trust, and a record that disappears when the channel does is hard to use. Knowing what actually happened to a file is part of controlling it.
What this means in practice
No single approach fits every file. A defined group of reviewers working through a deal for a defined period may be well served by a data room. A quick note to one outside person may only need the file to reach them. But for the documents that matter most, the ones where you’d want to answer “who can open this?” long after you sent it, controls that live on the file give you something channel-based controls can’t: the ability to see who has tried to open it and to change or end access afterward, whichever route it took to reach them.
This is the model behind SafeSuite and SafeSuite Lite, which protect files and email messages with a policy attached to them, and keep a history log of every access attempt so you can see what happened and change the policy when circumstances do.
See how SafeSuite keeps the controls on the file.
See it in action and get your specific questions answered.