Almost every file you share has a natural lifetime. Almost nobody sets one, because at the moment of sharing the file feels current and removing it later is a future person’s problem.
That future person does not exist.
The quiet accumulation
Think about what you shared eighteen months ago. A contract draft. A client delivery. An export for a colleague who has since left. A spreadsheet with a home address in it. A folder of photos from a project that ended.
Those links still work.
Nobody decided they should. It is simply that nothing ever decided they should not. The set only grows, because reviewing old shares is not a task that appears on anyone’s list, generates any urgency, or is anyone’s job.
An expiry date inverts the default: access ends unless you actively extend it, rather than continuing indefinitely unless you intervene. That single change is what turns link hygiene from a discipline into a property of the system.
Choosing a duration
The right answer comes from the file, not from a policy document. Some rough shapes:
A few days suits review copies, drafts, and anything you expect a response to this week. If it lapses before they look, they will ask, and issuing a new link takes seconds. The cost of being too short is trivial; the cost of being too long is unbounded.
Two to four weeks suits client deliveries. Long enough to survive a holiday, an approval chain or a slow week, short enough that the file is not still live next year.
A few months suits reference material a team draws on across a project. Set it to end when the project does.
No expiry is legitimate and should be deliberate. A portfolio piece, a public report, a document linked from your website - these should not stop working. The argument is not that everything must expire. It is that permanence should be a choice you made rather than a default you inherited.
A rough table
| What you are sharing | Sensible expiry |
|---|---|
| Draft for review | 7 days |
| Client delivery | 30 days |
| Invoice or statement | 30 days |
| Contract or signed document | 21 days |
| Anything with personal data | 7-14 days |
| Project reference material | End of project |
| Portfolio piece, public report | None - deliberately |
| Press or embargoed material | Until the embargo lifts |
None of these are rules. They are starting points that beat the current default, which is “forever, by accident”.
Expiry is not deletion
Worth being explicit, because this misunderstanding makes people hedge.
Expiring a link ends access through that URL. The file is still yours, still in your storage, still openable by you, and can be shared again with a new link in seconds.
Once that is clear, short expiries stop feeling risky. You are not throwing anything away, so there is no reason to pick thirty days “just in case” when seven is what the situation needs.
What expiry does not cover
Expiry answers how long. It does not answer who.
A link that expires in a week is still forwardable for that week, and if it reaches the wrong inbox on day one, the expiry has not helped. For anything sensitive you want both: a window, and a restriction on who can use it.
A password handles casual forwarding and works for recipients with no account. Restricting to named email addresses is stronger, because access follows identity rather than a shared secret and the record shows who actually opened it. Our guide to sharing sensitive documents covers choosing between them.
The combination is what makes the realistic failure survivable: a leaked link or password matters far less when it stops working on Friday.
Where this matters most
Two categories justify making expiry automatic rather than occasional.
Anything containing personal data about someone else. Client details, employee records, anything you would struggle to explain if asked why it was still publicly reachable two years after the engagement ended. Data protection regimes generally expect you to keep personal data no longer than necessary, and a share link that outlives its purpose is difficult to defend as necessary.
Anything shared outside your organisation. External access is precisely the kind nobody reviews, because the people who would notice are no longer in the conversation. When a contractor’s engagement ends, their access should end with it, and the most reliable way to arrange that is to have decided at the start.
Making it a habit
The practical trick is to set it at share time. That is the only moment you genuinely know how long the file should live - you are thinking about the project, the recipient and the deadline all at once. A week later you will not remember, and a year later you will not look.
If you are cleaning up an existing pile of old links, the useful sort is by recipient rather than by date: external people first, then anyone who has left, then everything attached to finished projects. Most of it can go, and the rest can get a date on it as it passes through your hands.
