You are eight people in a rented office above a hardware store, and your largest client just emailed a folder labeled “Draft Term Sheet.” Nobody told you what happens next. That is the ordinary version of this story, and it happens to small teams every week.
The instinct is to panic and buy enterprise software shaped for a 400 person bank. Skip that. You need three things: one home for sensitive files, a written rule about who gets in, and a habit of checking the log. That is the whole system. The rest is detail you can layer on as you grow, which is exactly how I would run it if I were sitting in your chair instead of writing about it.
Start by picking one place where anything confidential lives. Not a shared drive for some things and email attachments for others. One place. For teams handling contracts, investor materials, or legal paperwork, a virtual data room solution does this job because it puts permissions and an activity trail around the files themselves rather than around the folder they happen to sit in.
Why email and shared drives quietly stop working
Email was built to move messages, not to guard them. The moment a confidential document lands in an inbox, you have lost the ability to say who forwarded it, who printed it, or who still has a copy three years from now. Shared drives are better, but a drive answers one question only: can this person open the file? It cannot tell you whether they did, when, or how many times.
Here is the part that bites small teams. Your client does not care that you are tiny. They care that the folder they sent over gets handled like it matters. When something goes sideways, the first question is always the same. Who had access, and what did they see? If the honest answer is “we think it was just the three of us,” you have a problem that no apology fixes.
The International Chamber of Commerce publishes widely used confidentiality and non disclosure templates precisely because sensitive business information changes hands constantly between companies of every size. The paperwork protects you. Your file handling has to match it.
What the core controls actually do
Once files live in one controlled space, three settings carry most of the weight. You do not need to understand encryption math to use them, but you should understand what each one buys you.
- Access groups. You assign people to roles, not to individual files. New analyst joins mid project? Drop them into the group and they inherit the right permissions automatically.
- Download limits. Some documents should be viewable in the browser and never saved to a laptop. Toggle that per file.
- Activity logs. A running record of who opened what and when. This is the one people ignore until they desperately need it.
The National Institute of Standards and Technology treats access control and audit logging as foundational practices in its security guidance, not nice to haves. That lines up with what you see in practice. The teams that recover quickly from a leak scare are the teams that could answer the access question in under ten minutes.
Wait, does any of this apply to a team of six?
Yes, and this is where most advice goes wrong. Vendors market to law firms and investment banks because those deals are bigger, so small teams assume the tools are not built for them. Invert that. A six person shop has less margin for a messy document trail than a bank does, because you have no legal department to clean it up afterward.
The real constraint is not features. It is time. You have roughly two hours a week to spend on document hygiene, and any system that demands more will get abandoned by Thursday. So judge every tool by one measure: how fast can a new person use it correctly without training. If the answer is more than fifteen minutes, it is the wrong tool for you, no matter how good the feature list looks.
The three tier rule I would write on the wall
Skip the twelve page policy. Sort every confidential file into one of three buckets, and tell everyone which bucket they are allowed to touch.
- Tier one, open inside the company. Internal memos and planning docs. Everyone on the team can read them. No special handling.
- Tier two, named access. Client contracts, pricing, personnel records. You must be added to the file by name before you can open it. This is the default bucket for anything that would embarrass you if it leaked.
- Tier three, logged and locked. Deal documents, legal drafts, anything with a deadline and a counterparty. Named access plus download disabled plus the activity log reviewed weekly by one specific person.
Name that person in writing. Not “the team reviews it.” One human, one calendar reminder, every Friday afternoon. Rotating responsibility sounds fair and it is how things get dropped.
A short checklist you can run this week
Print this or paste it into your project tool. It takes one afternoon the first time and about ten minutes a month after that.
- List every place confidential files currently live. Shared drive, email folders, someone’s desktop, a chat app. All of it.
- Pick one of them to keep. Move everything into it within two weeks.
- Sort every file into tier one, two, or three. When unsure, go up a tier.
- Remove access for anyone who has left, gone on leave, or switched projects. Do this before you do anything else on this list.
- Turn on download restrictions for every tier three file.
- Write one sentence explaining what tier three means, and email it to the whole team.
- Set the Friday log review and put it on the calendar with the responsible person’s name on it.
What good looks like six months in
A legal or records question comes in from a client. You open the log, filter by file, and answer in a few minutes. That is the entire goal. Not a vault, not a bunker, just the ability to answer plainly when someone asks who saw what.
Small teams often assume security is a budget problem. It is closer to a habit problem. The Library of Congress has run preservation and records programs for generations, and the lesson that carries over is unglamorous: consistency beats sophistication. A modest system you actually use every week outperforms an impressive one you set up once and forgot.
Your team will not become security experts, and it does not need to. One home for sensitive files, three tiers, one named reviewer, one weekly check. That is enough to sleep through the night when a term sheet shows up unannounced.
So, which file on your drive right now would you struggle to explain if a client asked who opened it last? Go find it, and move it into tier three before you close your laptop today.