Where to Keep Company Files as Your Business Grows

Where should a growing company keep its files?

Keep company files in one shared workspace that the company owns, and keep customer documents attached to the customer's record. Personal drives are fine for drafts and notes, while anything another person may need belongs in shared space.

Few companies plan their way into a mess. Files start on the owner's laptop, then spread to personal cloud accounts, WhatsApp chats and email attachments. That works while everyone can ask the person at the next desk. It stops working when a new hire cannot find the current price list, or when a customer asks for a signed contract and the only copy sits with a salesperson on leave.

A short rule covers most cases:

Working documents that belong to a team go in that team's shared folder.
Documents about one customer, such as contracts and quotes, go on that customer's record or in a customer folder linked to it.
Personal drafts can stay in a personal drive until someone else needs them.
Chat and email are for sending files, and neither should hold the only copy.

What is the difference between a personal drive and a shared folder?

The difference is ownership: a file on a personal drive usually belongs to the person, while a file in a company shared space can belong to the company. Google's documentation shows this clearly. In My Drive, the owner is the individual who created the file. In a shared drive, Google says the organization owns the files, and they stay there after an admin deletes a departing member's account.

Microsoft 365 has a similar gap. When a user's account is deleted, that person's OneDrive enters a retention period of 30 days by default. The manager gets access if one is set, or a secondary owner if the company named one. Without either, nobody gets automatic access. After that period the OneDrive moves to a recycle bin for 93 days, and people lose access to anything shared from it.

Whichever tool you use, check how ownership works before you move anything. A folder shared from someone's personal drive can look like company storage while still depending on that person's account.

How should you structure company folders?

Build folders around how the company works, keep them shallow, and avoid folders named after people. Staff change jobs and leave, while Finance and Customers stay. Three or four levels are a sensible limit for most small companies, since deeper trees tend to hide files.

This layout suits many trading and service businesses:

Company: policies, licences, templates and brand files that most staff may read.
Departments: one folder each for sales, operations, finance and HR, with access limited to that team.
Customers: one folder per customer, using the exact name in your CRM, with subfolders for contracts, quotes and delivery documents.
Projects: one folder per project, moved to the archive when the project closes.
Archive: finished work you still have to keep, readable by a few people and editable by fewer.

What naming rule stops files getting lost?

A naming rule that fits on one page is enough, as long as the whole company uses it. Start each file name with the date in year, month, day order, such as 2026-11-02, so files sort correctly, then add the customer and the document type: 2026-11-02 Customer name signed contract. Use a version number in place of names like final2.

Customer names often appear in several spellings across Arabic and English, so copy the spelling from the customer record instead of typing it fresh. Give each top-level folder a named owner who decides what belongs there and clears it out twice a year.

Who should have access to which folders?

Give each person the access their job needs and no more. NIST calls this least privilege: restricting users' access to the minimum necessary for their assigned tasks. Grant access by team or department where you can, so a new hire gets the right folders on day one and someone changing teams loses the old ones.

Be more careful with edit rights than with read rights. In Google Drive, an editor of a folder can open, edit, delete or move any file in it, so one careless drag can relocate a customer's documents. Most staff need to read a contract, and very few need to change it. Check your tool's defaults as well. In a Google shared drive, for example, all members see all files unless a folder is set to limited access.

A simple way to sort your folders:

Whole company, read only: policies, templates and the price lists you want everyone using.
Team only: working files for sales, operations and projects.
Named people only: payroll, employment files, ID copies, bank details and legal disputes.
Every quarter, a manager reads the access list on restricted folders and removes anyone who no longer needs them.

How do you share a file link safely?

Share with named people wherever you can, and treat an open link like a key that works for anyone holding it. Google says the Anyone with the link setting lets anyone on the internet who has the link open the file without signing in. Microsoft describes its Anyone links as a transferable, revocable secret key: they can be forwarded, people using them do not authenticate, and their access cannot be audited. Its Specific people links work only for the people named, who have to sign in as themselves.

These habits prevent most accidents:

Send the link to a named email address when the file holds customer, staff or financial information.
Share the single file when that is all the person needs, since a folder share opens every file inside it.
Start with view access and raise it only for a reason.
Set an expiry date where your tool offers one. Google offers this on work and school accounts, up to one year ahead, and on folders only for viewers.
Remove access when the job ends. Microsoft notes that deleting an Anyone link cuts off everyone who used it.
Keep links out of group chats unless everyone in the group should open the file.
Check the address before you send, because a link sent to the wrong person is a disclosure you then have to deal with.

How do you keep customer documents tied to the customer?

Give every customer one record and attach the documents there, so anyone who opens the customer can see them. A Customers folder helps, but a folder cannot show the contract beside the open deal or last month's complaint. If you are still choosing a system, our guide to choosing a CRM includes the question of how you export attachments if you leave.

Decide which documents must live on the record. A typical list:

Signed contracts and renewals.
Accepted quotes and purchase orders.
Commercial registration, tax certificates and ID copies, with access limited to those who need them.
Delivery notes and signed proofs of delivery.
Anything sales promised in writing, so the delivery team can see it after the deal closes.

What rule keeps customer records complete?

Make whoever receives a document responsible for attaching it the same day. A signed contract that arrives on WhatsApp goes on the record before that person moves on. Keep one copy and link to it, because duplicates drift apart and nobody can say which one is current.

Test the rule each quarter. Pick five customers at random and ask a recent hire to find the signed contract from the record alone. Each miss tells you which team or document type needs attention.

What should happen to files when someone leaves?

Move the person's company files into shared space before you delete their account, and cut their access on their last day. The order matters. Google's admin steps suggest suspending the account first, so the person cannot create or move content during the transfer, and they warn that untransferred files in Trash are deleted with the user. In Microsoft 365, as described above, a countdown starts when the account is deleted.

Write this as a checklist with one owner, usually HR or the person's manager:

List what the person holds: their personal drive, the shared folders they own, their customer records and the links they sent to outsiders.
Transfer company files and customer documents to a named successor before the last day.
Reassign customer records so every document still has an owner.
Remove the person from teams, departments and restricted folders, and disable their sign-in.
Review external links they created, remove the ones no longer needed and share the rest again from the new owner.
Ask them to return company files held in personal email, on phones and on USB drives, and record this in the exit paperwork.
Delete the account only after a manager confirms nothing is missing.

What should you ask about backups?

Ask every provider which of your files are backed up, how far back you can restore, and when a restore was last tested. A shared folder is not a backup by itself, because a folder that syncs can pass a deletion along to every device. Put these questions in writing:

Are uploaded files covered, or only the database behind the application?
How often do backups run, and how long are they kept?
How long can we recover a file someone deleted, and who can do it?
Can you restore one file or folder, or only everything at once?
When did you last test a restore, and how long did it take?
Can we export all our files and folders whenever we want, and in what format?
Where are the files and their backups stored?

How should you back up files on your own machines?

Ask yourself the same questions about anything on your own computers or office server. The UK's National Cyber Security Centre advises small businesses to back up the data they need to operate, create two backups in case one is lost or stolen, disconnect external drives when not in use and turn on 2-step verification for online backups. It also says to know how to restore a backup and to check that it holds all your important data.

CISA's ransomware guide recommends offline, encrypted backups and regular tests of their availability and integrity, because many ransomware variants try to find and delete or encrypt accessible backups. Try a real restore at least once: pick a folder, bring it back and open the files.

What does data protection law mean for where you keep files?

Customer and staff files often hold personal data, so the law in your country can affect who sees them, how long you keep them and what you do after a leak. This section is general information, so confirm what applies to your business with a qualified adviser.

In Saudi Arabia, SDAIA regulates the processing of personal data. Its guide to the Personal Data Protection Law tells businesses not to keep personal data longer than they need it and to implement adequate security controls against loss, destruction or damage. It says a breach must be reported in the cases set by the Implementing Regulations. Law firm Clyde & Co reports the current deadline as 72 hours where harm is likely, and says SDAIA opened a consultation in October 2026 on draft changes that would remove that harm test, so check the current text.

In Jordan, the Ministry of Digital Economy and Entrepreneurship publishes Law No. 24 of 2023 with an unofficial English translation. In that text, Article 6 says processed data must not be kept after its purpose is fulfilled unless legislation says otherwise, and Article 8 requires measures against breaches and unauthorised disclosure. Article 20 covers a serious breach that could cause significant harm, with 24 hours to notify the affected people and 72 hours to notify the data protection unit.

Location can matter too. SDAIA lists a separate regulation on transferring personal data outside the Kingdom, and the Jordanian ministry's FAQ says data may be transferred and stored abroad under the conditions in Articles 14 and 15. Ask your provider where files are stored and take the answer to your adviser. Do the same before deleting old records, since tax or employment rules may require you to keep some of them for a set period. If you operate in Iraq, ask a local adviser which rules apply.

How does Repzo handle this?

Drive is the file workspace inside Repzo Workstation. Its files and folders are tied to your team, customers and operating records, and linked CRM attachments are among its listed features, so customer documents sit in the same workspace as your sales CRM.

You can share a folder or a single file with view or edit access, with internal users, departments or an external email address. External recipients get a secure invite link that opens the shared item without joining the workspace. Before a download goes through, Drive checks owner, folder share, file share and workspace permissions. Search, previews, stars and starred and recent views help people find what they need.

Some answers depend on your setup and are better confirmed directly. Ask our sales team about link expiry, files owned by departing staff, how files are backed up and restored, and where they are stored. The 7-day free trial lets you test your folder structure and sharing rules with a real team first.

Frequently asked questions

Is Google Drive or OneDrive enough for a small company?

Either can work for general company files, provided staff use company accounts and shared spaces. The gap to check is the link to your customer records. If people have to search a separate tool for a customer's contract, decide how the two will connect.

Can staff keep work files in their personal email or personal cloud account?

It is better to avoid this. The company cannot transfer files from an account it does not control, or remove them when the person leaves. Give staff a company account for drafts and a shared space for everything else.

How long should we keep customer documents?

There is no single answer. SDAIA's guide says not to keep personal data longer than you need it, and Jordan's law says the same once the purpose is fulfilled unless legislation says otherwise. Other rules may require you to keep certain records, so agree the periods with an adviser.

Is it safe to send a contract by public link?

It carries more risk than sharing with a named person, because anyone who gets an open link can use it. Send the contract to a named address with view access, set an expiry date if your tool offers one, and remove access when the job is done.

Should customer files live in the CRM or in a shared drive?

Either can work if every document can be reached from the customer's record and only one copy exists. Pick one home for each document type, write it down, and test it by asking a colleague to find a signed contract from the record.

What is the first step to clean up a messy shared drive?

Avoid moving everything at once. Set up the new structure, put all new files there, and move your active customers first. Make the old folders read only as an archive, name an owner for each area, and bring files across when someone needs them.

Where should a growing company keep its files so people can find them?

The short answer

Key takeaways