A share link is a standing permission. It keeps working until somebody takes it away, and most of the links that leave a leasing office are never taken away.
The platforms are plain about what the setting grants. Microsoft describes its Anyone links as "links that anyone who has the link can access the files or folders without authenticating." Google's help page says of Anyone with the link: "Anyone who has the link can use your file, without signing in to their Google Account." No account, no name, no identity check. The link is the credential.
You cannot see who is holding it
Microsoft's own description of the Anyone with the link option says that "forwarded links work internally or externally, but you can't track who has access to shared items or who has accessed shared items." One forward out of a recipient's inbox and your audience grows by an unknown number, with no record for you to read.
Folder links compound it. A folder link covers what you put in the folder afterwards, so the statements you upload next quarter inherit the audience you set last spring.
The link outlives the relationship
This work produces exactly the files you would not choose to leave standing open: application packages with pay stubs and credit summaries, move-in condition photos of an occupied suite, an owner statement with the rent roll attached, a vendor folder of suite numbers and lockbox notes.
Every one of those was shared for a relationship that ends. The applicant you declined. The owner who sold the building. The contractor you stopped calling. The leasing agent who left in March. The relationship ends and the permission does not, which is a different problem from how long you are allowed to keep a declined application on file, and it does not show up in any of the places you would look.
PIPEDA's safeguards principle asks you to protect personal information against "loss, theft, or any unauthorized access, disclosure, copying, use or modification." The Privacy Commissioner lists the distribution of the information among the factors that decide how strong those safeguards have to be. A permanent public URL carrying a credit summary scores badly on that one.
Three changes that hold
- Put expiry in the admin settings, not in anyone's habits. In the SharePoint admin centre, under Policies and then Sharing, you can require every Anyone link to expire within a maximum number of days. Microsoft flags one catch: when you change that limit, existing links keep their current expiry if the new setting is longer, and only move if it is shorter. Google's version expires a named person's access rather than a link, and its help page says the feature is "only available for eligible work or school accounts."
- Share anything with a person's name in it to an email address, not to a URL. Named access costs one step and buys two things a link cannot: a list of who has access that you can still read a year later, and one click to remove a name from it.
- Add revocation to checklists you already run. Offboarding a staff member, closing a declined file, handing a building to a new manager, replacing a vendor. Each of those is a moment when a link should die, and not one of them will prompt you on its own.
Where to start
Start with the folders you sent out this year: owner reporting, turnover photos, vendor access. Open the sharing settings on each and read the general access line. Anything set to anyone with the link is open to everyone it was ever forwarded to, and the file will not tell you who that is.
The habit underneath this is treating a link like an attachment, something that lands once and is finished. A link behaves more like a tap. It runs until you reach over and close it.