Security rarely feels urgent for freelance and small-agency work — until a client asks "who else can see this?" and you don't have a confident answer. Client trust is built on dozens of small signals, and how you handle their files is one of the more consequential ones, precisely because clients notice it even when they can't articulate why.
Here are five concrete signs it's time to tighten up your delivery setup.
1. Your share links never expire
A link you sent three projects ago, to a client relationship that's since ended, that still resolves to a live file — that's not a hypothetical risk, it's just an open door you forgot about. Every link you've ever generated should have a clear lifecycle: active, expired, or explicitly revoked. If you can't currently answer "which of my old share links still work," that's the first thing to fix.
2. Anyone with the link can see everything
Scoping matters. A share link for one deliverable shouldn't also expose every other project you have with that client, and definitely shouldn't expose other clients' work if links are ever guessed, forwarded, or leaked. Scope should be explicit and minimal by default — this specific deliverable, or this specific project, not "everything in your account."
3. There's no password option for sensitive work
Not every delivery needs a password, but some clearly do — pre-launch marketing assets, unreleased product designs, anything with legal or competitive sensitivity. If your delivery method has no password option at all, you're making that decision for every client, on every project, whether or not it's the right one.
4. You can't see who viewed or downloaded what
This one matters less for security in the narrow sense and more for the trust conversation that follows an incident. If a client asks "did anyone else download this?" and you have no activity record at all, you're left saying "I don't know" — which is a bad position to be in even when nothing actually went wrong.
5. Files are only ever handed out as permanent public URLs
A permanently public URL to a file in cloud storage is the single most common security gap in freelance delivery, because it's the path of least resistance: drag a file into a shared folder, copy the link, done. The problem is that "public" and "permanent" compound — anyone who ever had that link still has it, indefinitely, with no way for you to revoke access to that specific file without breaking every other link that touches the same folder.
The fix is short-lived, purpose-specific access: a signed URL that's valid for minutes, generated fresh each time a file is actually requested, rather than a permanent public link generated once and forgotten.
None of this requires a security background
You don't need to become a security professional to close these gaps — you need a delivery process where the secure option is also the default option, so you're not making a fresh security decision on every project under deadline pressure. That's the actual goal: not vigilance, but a system where the easy path and the safe path are the same path.