Monday morning, before quotes came client data
The first thing I did on Monday morning wasn't write a quote. I opened my client spreadsheet to prepare a contract for a freelance photographer surnamed Chen, then froze when I saw “shared tax ID link” in the search box. The file held names, but also ID numbers and payment details. My one-person team also tossed client spreadsheets into cloud drives for easy access, without seriously considering what happened if someone saw the link. I got stuck on this too. Brazil's Caixa breach affected roughly 7.6 million customers, exposing names and tax IDs. For us, platform size doesn't make the risk a big-company problem.
The software didn't break; we just made storing data too easy
Concentrated insurance records were accessed externally. That sounds cinematic, but for a small business it usually means keeping a client list on a personal cloud drive, sending a shared link to a collaborator, leaving data on old computers, or allowing a departing team member to keep downloading it. Chen Lan, who runs corporate training in Guangzhou, used a shared folder to collect student details every day. She eventually changed one thing: she moved the original spreadsheet out of her usual folder, gave everyone an individual link, set expiration dates, and cleared out old files once a week. “I didn't get smarter,” she said. “I finally stopped leaving every key on the same hook.” Not everyone needs this setup, though. If you only keep names and email addresses, you don't have to change tools today.
Close the gap today: low cost, start with the least glamorous step
Replication cost: 0 in additional fees; about 2 hours to organize; the technical barrier is knowing where to change sharing permissions—no coding needed. First, open the cloud drive or file tool you already use, find the folder holding your client list, and select “Share” or “Permission settings.” Change the link to “Specific people only.” If that option doesn't exist, create a lean spreadsheet containing only contact details, with no ID or bank card numbers. Generate passwords in a password manager instead of using a birthday plus phone number. Next, ask a colleague or friend to test the setup: try the old unauthorized link and confirm the file can't be opened. Then create a quarterly reminder to remove expired shared links and old spreadsheets from retired computers.
Match the fix to your stage; don't do it all tonight
If you're just starting with a dozen records, I'd begin with a minimal inventory and separate ID details from payment information. There's no need to buy a complex system; closing public links today is enough. If you already have one or two steady clients, I'd label each file with the client name and date and spend 20 minutes checking permissions each month. If you're scaling, I'd assign a fixed owner for collecting, accessing, and deleting data, and require partners to use temporary links. I'd also run an audit of old links because I've forgotten to delete shared files before—until someone messaged me. It's fine if you don't test today. Start by asking once: “Who can open my client spreadsheet?” That's the most practical beginning.