External sharing controls that actually work: expiry, watermark, logs, revocation

The link is where control usually ends Inside a workspace you have identities, roles and logs. The moment you send a link outside, most products fall back to a URL with a permission check. If the hosting provider can read the file, every control above it is discretionary.

Four controls that change outcomes - **Passphrase plus key in the fragment.** Browsers never transmit the part of a URL after the hash sign, so the decryption key can travel with the link without reaching the server. A passphrase derived with Argon2id gates the actual open. - **Expiry by default.** Links should have a maximum lifetime and be destroyed automatically. A forgotten link then stops being a permanent hole. - **View-once and view budgets.** Capping opens and counting them tells you when a link was used more than expected. - **Watermarked viewing.** Displaying sensitive material in a protected viewer that stamps context makes a leaked screenshot attributable.

One recipient, one link The single highest-leverage habit in external sharing. It costs seconds, and it is the difference between "someone leaked it" and "this specific channel leaked it".

Logs without a new liability Access logs should record events — created, opened, revoked, expired — and nothing about the content. That gives an investigation what it needs without building a second pool of sensitive data.

Revocation must be immediate and recorded When a deal collapses or a partner changes, killing the link should be one action, effective immediately, and written to the trail. Anything slower turns into a task nobody does.

What none of this replaces Link controls do not stop a recipient who is determined to copy what they were legitimately shown. They shrink the window, make the exposure attributable, and end it quickly — which, in practice, is what limits the damage.