TL;DR: OneDrive encrypts files in transit and at rest, but encryption isn't what breaks when client documents live there. Permissions drift, "anyone with the link" shares outlive the reason they were created, and nobody owns an audit trail across a client relationship. A digital vault built around the relationship — not the folder — closes that gap.
By Sidney AI, Editorial Team at SideDrawer
A client emails a signed trust document. Someone on your team drops it into a OneDrive folder and sends back a link. Six months later that link still works, the client's adult son has somehow picked up access to it through a shared family folder, and nobody on your team can say with certainty who else has opened it. No one broke in. No setting was wrong by any checklist IT would run. The link just kept working, the way OneDrive links do unless somebody remembers to make them stop.
OneDrive's infrastructure holds up — data is encrypted in transit and at rest, and Microsoft isn't the weak point in that chain. The weak point is everything that happens after a file is shared: who still has access a year later, whether that access was ever reviewed, and whether anyone would know if it went wrong. A firm can pass every IT security checklist on OneDrive and still have no answer to an auditor asking who touched a specific client's documents over the past eighteen months.
Permissions don't get revoked on their own. A "anyone with the link" share has no expiration unless a person sets one, and most people don't, because OneDrive never prompts them to. Employees leave and their old shares often outlive the employment itself by months, quietly, with nobody auditing the list. And because client folders tend to get nested inside broader team or family shares over time, access meant for one party in a relationship has a way of reaching a second party nobody intended to include.
Verizon's 2026 Data Breach Investigations Report found that human error — not an external attacker — now drives nearly 9% of all confirmed breaches, led by misdelivery and misconfiguration (Verizon, 2026). Put plainly: most of what goes wrong with a shared file isn't someone hacking in. It's someone forgetting to lock a door that was supposed to close on its own.
Security research from Sublime Security found that 12% of observed email attacks in 2026 abused legitimate cloud services — including Google Drive, OneDrive, and SharePoint — specifically to slip past infrastructure-based filters built to flag suspicious senders (Sublime Security, 2026 — vendor-commissioned research). A link shared through OneDrive arrives from a domain every filter already trusts, which is precisely why attackers have started routing through it.
No single firm's IT policy fixes that, because the exposure doesn't come from how your team configures OneDrive. It comes from what OneDrive's own reputation lets slip past everyone else's defenses first.
OneDrive organizes around files and folders. A client relationship is a different shape entirely — an ongoing, multi-party arrangement that might eventually include a spouse, an accountant, a lawyer handling an estate matter, or an adult child stepping in to manage a parent's affairs. OneDrive has no structure built for any of that. Firms invent one themselves: a naming convention here, a manual permission there, usually documented nowhere except in the memory of whoever set it up.
That improvised structure is the real cost, and it doesn't show up on a feature comparison chart next to "encryption: yes." A tool can encrypt everything it stores and still leave a firm with no reliable record of who was ever allowed into a given client's documents, or when that access should have ended.
Security that only covers a firm's own side of the exchange is a compliance checkbox, not protection. As John Baynham of Retirement Income Group put it:
"It's great if we are encrypting and taking steps to be cybersecure, but if our clients aren't secure when interacting with us, that's a huge gap in our offering. This is why the two-way secure exchange through SideDrawer was essential to fill this gap."
A OneDrive-based workflow can satisfy every item on a firm's own security review and still have zero visibility into whether the actual point of failure was a client's inbox, a shared family computer, or a relative who was never supposed to be in the loop.
A digital vault built per client relationship gives each relationship its own contained space, defined roles for every participant, and a full audit trail of who accessed what and when — generated automatically, not reconstructed after the fact. Approve/reject workflows replace the habit of dropping a file into a shared folder with a structured exchange that logs itself. When a lawyer needs to join an estate matter, they're added as a collaborator inside that one relationship's vault, with access scoped to exactly that relationship — not granted entry to a folder that happens to hold five other things.
For the fuller framework on how firms evaluate and adopt structure like this, see Digital Vaults 101. For related coverage of access-governance gaps elsewhere in a firm's stack, see shadow AI and vault governance and our full review of digital vault platforms.
Is OneDrive secure file sharing? OneDrive's infrastructure is encrypted in transit and at rest, which covers basic data security. It has no per-relationship access structure, no automatic link expiration, and no standing audit trail across a client relationship — the gaps that actually cause incidents at a regulated firm.
Can anyone see my files on OneDrive? Anyone holding an active "anyone with the link" share can, along with anyone whose access from a past share was never revoked. OneDrive doesn't review or expire old shares on its own, so access tends to persist long after the reason for granting it is gone.
What is a disadvantage of using OneDrive for client documents? It's folder-centric, with no built-in way to structure a multi-party client relationship. Firms end up building that structure themselves, out of naming conventions and manual permissions, instead of relying on a system that enforces it.
Which is safer, OneDrive or Google Drive, for client files? Their infrastructure-level encryption is comparable. Neither is built for structured client-relationship management, audit trails, or approve/reject workflows, which makes the more useful question for a regulated practice not which general-purpose drive edges out the other, but whether general-purpose cloud storage belongs in a client-document workflow in the first place.
How do I know if my OneDrive files are shared, and with whom? OneDrive shows sharing activity per file, but only if someone checks each file individually. There's no automatic audit trail surfacing that across an entire client relationship the way a structured vault does.
See how a digital vault replaces folder-by-folder guesswork with a structured, auditable record per client relationship — book a 30-minute demo.