Secure file sharing for client portals

When you send a client a link from Spaces, it opens as a clean page carrying your logo — and from the Team plan up, your own domain — that they can browse, play and download from without an account, a login, or a moment’s confusion. Feedback happens right there too, still without an account: a note pinned to the exact second of a cut, a mark drawn on the frame of an image, a reply that lands back with your team. Permissions follow the way studios really delegate: a client sees only what they were sent, a freelancer sees only what they were brought on for, an account lead sees the full picture, and any area can be closed off to its owner alone when the work isn’t meant for the room. So the “portal” a client meets is a slice of your workspace scoped to them — never the whole thing.

Every share keeps its own record. Because the worst part of the work is the silence after you hit send — the not knowing whether it arrived, whether they opened it, whether the email got through at all — the link counts opens and downloads separately, and tells you the moment someone first lands on the page. The morning after a delivery, that’s one screen to glance at instead of an email you don’t want to write: opened two hours ago, five downloads. The chasing stops because the answer is already there.

An open link is right for most deliveries, and wrong for some — the unreleased campaign, the cut under embargo, the record that isn’t out yet. For those, a share can be locked to a named list of people. Each person on the list proves their email once, with a short code, and from then on the page simply knows them on that device; anyone else who gets hold of the URL meets a closed door. There is still no account to create and no password to lose — the proof is the inbox they already own.

The list stays live. Remove a name — the freelancer who rolled off, the contact who left the client — and that person is locked out at their next visit, not at the next time you remember to rotate a link. And expiry here means what it says: shares default to expiring after thirty days, and when one does, the shared copies are genuinely deleted from storage — not a link quietly unpublished with the files still sitting behind it.

Your files live in Amsterdam, on infrastructure in the EU, encrypted at rest and in transit, and nothing you upload is ever fed to a model — ours or anyone else’s. It is never mined and never sold. Every share, move and deletion is written to a log you can read back later; anything you delete stays recoverable for thirty days; and if you ever decide to leave, your files export cleanly, in formats other tools can read.

One detail worth knowing because nobody thinks to ask: your team’s internal comments and a client’s view of the conversation are kept structurally apart. A note marked internal cannot appear on a share page — not hidden by a setting someone might get wrong, but separated in the way the system stores them. There’s a fuller account on the security page, and the contractual side is set out in the DPA.

A generic drive gives you a folder and a share link, and stops there — so the review happens somewhere else, the sign-off happens somewhere else, and the thread of who approved what gets dropped on the floor. In Spaces the files, the comments welded to the moment they’re about, and the approvals all live in one place you can find a year later. And the bill is different in kind: most tools charge per seat, so the cost climbs every time you add a person or bring a client into view, whereas Spaces charges for storage alone and lets you invite as many teammates as you like at no extra cost.