Encryption is the quiet control that decides whether a stolen file is a disaster or a non-event. Yet many businesses cannot say which of their files are encrypted, who holds the keys or what happens when a link is forwarded. IBM’s 2024 Cost of a Data Breach report put the global average breach cost at USD 4.88 million, and Verizon’s 2024 Data Breach Investigations Report found a human element in 68 percent of breaches. Encryption cannot fix careless behaviour, but it limits the damage when mistakes happen. This guide is for business owners, finance and legal leaders and IT managers who share sensitive documents with advisers, clients or investors. It explains how encryption works in plain terms, where it commonly fails, and how a dealroom or similar secure platform combines it with the permission controls that make file sharing safe.
Encryption in Plain English
Encryption scrambles data using a mathematical key so that only someone holding the right key can read it. Without the key, intercepted or stolen data appears as meaningless characters.
Encryption at Rest and in Transit
Two states of data matter. Data in transit is moving between devices, for example from your laptop to a cloud server. It is protected by protocols such as TLS (Transport Layer Security), the technology behind the padlock in your browser. Data at rest is stored on a server, laptop or backup. It is commonly protected with AES-256, a standard used by governments and financial institutions worldwide.
A business needs both. A platform that encrypts storage but sends files over unprotected connections leaves a gap, and so does the reverse.
Who Holds the Keys?
The most overlooked question in encryption is key management. With provider-managed keys, the vendor controls encryption on your behalf, which is convenient but means the vendor could technically access data. With customer-managed keys, you control the keys and can revoke access. End-to-end encryption goes further, ensuring only the sender and recipient can read content, though it can limit features such as server-side search and virus scanning. There is no universally best answer; the right model depends on the sensitivity of your data and your regulatory duties.
Where Encryption Alone Falls Short
Encryption protects data from people who should never see it. It does not stop an authorised person from sharing it. Three common failures illustrate the point.
-
Over-permissive links. In 2023, security researchers at Wiz reported that Microsoft’s AI research team had accidentally exposed around 38 terabytes of internal data through an overly permissive storage access link published in a public repository. The data was stored on an encrypted cloud service, but the link granted broad access.
-
Misconfiguration. The 2019 Capital One breach, which affected roughly 100 million customers in the United States and Canada, stemmed from a misconfigured cloud firewall rather than a failure of encryption algorithms.
-
Weak credentials. The 2012 Dropbox incident, which came to light in 2016 and involved about 68 million user credentials, showed how reused passwords can undermine otherwise robust systems.
The lesson is that secure sharing needs encryption plus authentication, permissions and monitoring working together.
The Building Blocks of Secure File Sharing
A business-grade solution should provide more than a padlock icon.
-
Strong authentication. Multi-factor authentication for every user, including external guests.
-
Granular permissions. Control access by person, folder and document, with options such as view-only, no printing and no download.
-
Expiry and revocation. Links and access should end automatically, and you should be able to cut access instantly.
-
Dynamic watermarking. Overlay the viewer’s name, email and timestamp on each page to deter leaks.
-
Audit logs. A tamper-resistant record of who accessed what and when.
-
Data loss prevention. Controls that restrict copying, screenshots or forwarding of the most sensitive files.
Why View-Only Controls Matter
Once a recipient downloads a file, you lose control of it. They can forward it, print it or store it on an unprotected device. View-only mode, with rendering done in a protected viewer, keeps documents on your platform while still allowing review. For sensitive negotiations, this single setting often matters more than any algorithm.
How a Dealroom Applies These Controls in Practice
A dealroom, also called a virtual data room, is a secure online workspace built for sharing confidential documents during transactions such as fundraising, M&A, financing and audits. It packages the controls above into a structure that mirrors how deals actually work.
Typical dealroom capabilities include:
-
Separate groups for bidders, advisers and internal teams, each with its own permissions
-
Staged release of documents as negotiations progress
-
Built-in Q&A with approval workflows
-
Analytics showing which documents each party has viewed and for how long
-
Automatic archiving of the room and logs after closing
Because each action is recorded, a well-run room does more than prevent leaks. It gives you evidence of how information was handled, which can be valuable if a dispute or regulatory question arises later.
Choosing Between Tools
Not every task needs one. Use a lighter tool for routine internal collaboration, and a specialised platform when you share high-value or regulated information with external parties. A simple test: if a leak of the document set would damage a transaction, a customer relationship or your legal position, treat it as transaction-grade material.
Testing Your Setup
Before trusting any platform, test it as an attacker or careless user would. Create a dummy document, share it with an external test account and try to forward, download and print it. Check whether the link still works after you revoke access, and whether the audit log recorded every attempt. Repeat the exercise each time you change permission settings. Ten minutes of testing often reveals gaps that no vendor brochure mentions.
Compliance Considerations for Australian Businesses
Encryption and secure sharing support, but do not automatically satisfy, legal obligations. Under the Privacy Act 1988, organisations covered by the Australian Privacy Principles must take reasonable steps to protect personal information, and the Notifiable Data Breaches scheme requires notification of eligible breaches. Regulated financial entities must also consider APRA’s CPS 234 on information security. Ask vendors where data is stored, how it is backed up and whether they support audit requests. Document the answers as evidence of reasonable steps.
A Practical Policy for Your Team
Technology works best when staff know how to use it. A short policy should cover:
-
Which categories of information may be shared externally, and through which tools
-
Mandatory use of approved platforms rather than personal email or messaging apps
-
Rules for naming and classifying sensitive files
-
Required approval for sharing the most sensitive documents
-
Procedures for revoking access when staff or advisers leave
-
Steps to follow when someone suspects a document has been shared in error
Review the policy yearly and test it with simulated scenarios, such as asking a team to share a confidential file with a new adviser and seeing which route they take.
Common Mistakes to Avoid
-
Assuming “cloud” means “secure.” Security depends on configuration and controls, not on location.
-
Sending passwords in the same email as the file. Use a separate channel.
-
Leaving old access active. Review permissions after every project.
-
Ignoring mobile devices. Require device encryption and screen locks.
-
Skipping logs. Logs are valuable only if someone reviews them, at least after key events.
Conclusion
Encryption is essential, but it is only one layer. Protect data in transit and at rest, understand who controls the keys, and pair encryption with strong authentication, granular permissions, expiry and audit logs. For sensitive transactions, a dealroom brings these protections together in a structure designed for outside parties. Start by auditing how your team shares files today, identify the three riskiest habits and replace them with a controlled alternative. Small changes in process often deliver larger security gains than any new technology purchase.