How to Manage File Access and Permissions for Contractors

August 15, 2026

The default way small businesses give a contractor access is to share the folder that contains what they need, which is usually a folder that also contains eleven things they shouldn't see. It works, nobody notices, and the access stays live for years after the project ends.

This isn't paranoia about contractors. It's that access you've forgotten about is access you can't manage — and the risk isn't the person, it's their account, their laptop, and the next person they hand it to.

Structure for access before you need it

Permission problems are usually structure problems. If a contractor needs one client's files and your folders are organized so that means giving them all clients, the folder structure is the thing to fix.

The rule: the unit you'd ever share should be a folder, not a selection of files. That means one folder per client, one folder per project, one folder per product — each self-contained enough to hand over whole.

Where that isn't possible, add a share folder inside:

03 Clients/
  Northwind Design/
    01 Contracts/          ← never shared
    02 Briefs & Notes/
    03 Working/
    04 Deliverables/
    _SHARED-contractor/    ← shared with outside help

An explicit shared subfolder is worth the small awkwardness because it's visible. You can see at a glance which folders have outside eyes on them. Inherited permissions three levels deep are invisible, and invisible permissions are the ones that survive for years.

Give the least access that lets them work

Three questions before sharing anything:

How much? The single folder for the project, not the parent. This is the one people get wrong most, because sharing the parent is one click easier.

What rights? Most contractors need to view and to add files — not to delete, not to reshare, not to manage permissions. Most platforms have a "contributor" or "editor" level below "manager." Use it. The reshare right in particular is one to withhold by default; it's how access spreads to people you never approved.

For how long? Set an expiry date at the moment you share, if your platform supports it. Expiring access is the only kind that reliably gets removed, because it removes itself.

Share with a named account, never a public link. A link that works for anyone who has it is a link that works for anyone it's forwarded to, and forwarding happens innocently all the time. If you must use a link, set it to expire and to require a password.

The access register

One spreadsheet, 01 Admin/Access Register.xlsx, and it covers more than files:

Person | Role | What they have | Access level | Granted | Expires | Removed
M. Alvarez | Design contractor | Clients/Northwind/_SHARED | Editor | 2025-02-01 | 2025-05-01 |
M. Alvarez | Design contractor | Brand assets folder | Viewer | 2025-02-01 | 2025-05-01 |
M. Alvarez | Design contractor | Design software seat | User | 2025-02-01 | 2025-05-01 |
J. Okafor | Bookkeeper | Finance/2025 | Editor | 2024-01-15 | ongoing |

Every row is one grant. When someone leaves, you filter by their name and work down the list. Without a register, offboarding is done from memory, and memory reliably misses the third and fourth items.

Include everything, not just the drive: software seats, shop admin, email accounts, scheduling tools, password manager entries, social accounts, hosting, analytics. The forgotten access is almost never the main drive — it's the analytics account or the design tool seat.

What contractors should never get

Some access is never appropriate to delegate to an outside contractor, regardless of trust or convenience:

Banking and payment processor logins
Your primary email account
Domain registrar access
The owner or super-admin role on any platform
Client contracts and rate information for other clients
Personal data about customers beyond what the task requires
The password manager itself, as opposed to individual shared credentials

If a task genuinely requires one of these, that's a signal to reconsider the task, not to grant the access. A bookkeeper needs read access to statements, not the ability to move money. A social media contractor needs a manager role on the page, not ownership of it.

Handle credentials with a password manager, always

Never send a password in email, chat, or a document. It's not that the message is likely to be intercepted — it's that it will still be sitting in a searchable archive in five years, long after everything else has been revoked.

Use a password manager with sharing. The person gets the credential without seeing the password, you revoke it in one click, and you can rotate it centrally when they leave.

Where a service supports individual accounts, use those instead of sharing a login at all. Individual accounts can be removed without disrupting anyone else, and they produce an audit trail showing who did what.

Put it in the contract

Before the first share, three clauses should exist in writing:

Confidentiality — what they can't disclose, covering client information and business data.

IP assignment — that work product belongs to you. Without this, in many jurisdictions, a contractor may retain copyright in what they created, which becomes a genuine problem when you sell the business or the product.

Return and deletion — that on completion, they return materials and delete their own copies, and confirm it.

That third clause is worth having even though you can't enforce it perfectly, because it makes the deletion request routine rather than awkward, and because contractors generally will comply if asked. Local files on a contractor's machine are the part of your data you'll never control; the contract and the ask are the tools you have.

Offboarding: the same day, from the register

The project ends. Same day, not "when I get a moment":

Open the access register, filter to that person.
Remove each grant, dating the Removed column as you go.
Change any shared credential they had access to, even if you've removed their access to the manager.
Transfer ownership of anything they created that's owned by their account — this is the one that bites. On several platforms, files created by a contractor's account belong to that account, and when it's removed the files can go with it.
Send the deletion request in writing, referencing the contract clause.
Check for public links they may have created in shared folders.

Step four deserves emphasis. Before removing anyone, search the shared space for items owned by them and transfer ownership. Doing this after removal ranges from difficult to impossible.

Quarterly access review

Fifteen minutes, once a quarter. Open the register and open each platform's member list side by side.

You are looking for two things: people in the platform who aren't in the register, and people in the register whose work ended. Both are common, and the first is more interesting — it usually means someone was added without going through the process, which tells you the process needs a step.

Also check for public sharing links across your drive. Most platforms can report on these. Links created for a quick handoff two years ago are still live, and that's the most common real exposure in a small business.

Next in this series: How to Organize Marketing Assets, Logos, and Brand Files