Clients trust you with their data and want proof that you’ll keep it safe, but without a security expert on your team, you may not know where your files are exposed.
If you’re in healthcare or another regulated industry, the law expects you to know these risks and prevent them. In other industries, like software development or professional consulting, confidentiality is written into contracts to protect clients’ intellectual property and business plans.
Whichever sector you serve, security is becoming more important to your customers. In Proton’s 2026 survey of 3,000 business leaders, 65% said showing secure handling of client data is critical or very important to winning new work.
This guide covers the seven most common ways client data leaks from a business your size, and how to fix each one, so you can show clients their data is safe with you.
1. Your laptop and phone
Attackers get access to your device by stealing or borrowing it, or by tricking you into installing malware.
“Malware(nytt fönster)” is the umbrella term: it covers ransomware, remote access trojans, spyware and more. Some types give a cybercriminal undetected and ongoing access to everything on the device at once. Unsuspecting users see them in phishing emails, malicious ads and “free” software downloads.
Infostealers are a kind of malware built to steal your data. They take screenshots, collect files and emails, and copy your browser’s session cookies, so they can sign in as you without a password.
One habit: Keep client files in one place, and delete the copy in Downloads when you’re done.
2. Passwords and logins
Criminals don’t guess passwords. They buy the ones they find in leaked company breaches and use automated tools to try them everywhere, a tactic called credential stuffing.
To their luck, they can get in, because as many as 65% of people reuse passwords on multiple accounts, often enough to make it pay off. Even one match opens that account and every file inside it. If you share a password with a team member or collaborator, that adds a risk of their own because you can’t tell who else has them.
One habit: Use a password manager to create a long, unique password for every account, and share logins through a shared vault, so you can see who has access and remove it when a job ends.
3. Files sent by email
Every attachment leaves copies three places: in your sent folder, on mail servers, and in every recipient’s inbox.
Your sent folder. Anyone who breaks into your account can search every attachment you’ve ever sent for words like “invoice,” “payment,” and “wire,” where client names and payment details are easy to find. Some also set up forwarding rules that send them a copy of every email containing those words, as the FBI has warned(nytt fönster).
Mail servers. Copies stay on your provider’s servers. Standard email, the kind most people send, isn’t end-to-end encrypted. It’s only encrypted while it travels between mail servers, using a standard called TLS. End-to-end encryption keeps a message readable only by you and the recipient, not by your provider.
The recipient’s inbox. Once it lands, it can be read there, including by anyone who breaks into that inbox. Even a photo’s metadata shows where and when it was taken. You can’t control their inbox, but you can control what’s in it: password-protect the file, or send it by end-to-end encrypted email, so a break-in finds nothing readable.
One habit: Send a link with a password and an expiry date instead of attaching the file, so no copy sits in those three places and you can switch it off if it reaches the wrong person.
4. Shared file links
Hackers look for share links because they don’t need a password to learn more about the company or person they’re planning to attack.
In a Proton survey of 1,000 adults in the US, UK, Germany and France, 67% of US respondents still had access to shared files they no longer needed, and 24% of French respondents shared spreadsheets as “anyone with the link can view.” Links sent to ex-partners, former flatmates, and old travel groups kept working long after the relationship or project ended.
At work, the stakes are higher. The freelancer you shared a folder with last year probably won’t misuse it, but if their inbox is broken into, the attacker gets your client’s files too. You’ll have breached your client’s confidentiality without knowing it happened.
One habit: Set a password and an expiry date on every link you share, and send the password by a different route than the link.
5. Meeting invites and recordings
The FBI haswarned about uninvited guests joining video meetings(nytt fönster), often through links shared too widely or meetings with no password. Once inside, they can hear client names and topics, see who attends, and may be able to replay a recording.
In 2024, a Webex call among senior German air force officers was recorded and published by Russian state media after one participant joined from a hotel in Singapore on a non-secure line, which Germany’s defense minister called(nytt fönster) an individual’s operational mistake.
One habit: Send each meeting link only to the people invited. A forwarded link lets anyone join the call. Keep event titles generic too, like “Call with client.” Titles show up in lock-screen notifications, shared calendars and synced apps, where a name like “Acme acquisition review” can reveal a deal before it’s public.
6. Your cloud storage provider
Every file you upload sits on your provider’s servers. If they hold the keys to your files (which many of them do to make search and previews work), anyone who uses (or steals) their copies can read the file.
Those intruders could be their own staff, anyone who breaks in, or even authorities with a warrant, subpoena or court order. In the US, the CLOUD Act(nytt fönster) lets them demand data from US-based providers even when it’s stored abroad.
Zero-access encryption works like a locked box: it protects your data at storage. A provider that uses it can store your documents, including your file names, folder names and previews, but they can’t open it. Your files are scrambled on your own device before they’re uploaded, and the key that unscrambles them stays with you.
One habit: Look for an explicit zero-access or end-to-end encryption promise on your provider’s website. Either one means your files are locked with a key only you hold, so there’s nothing readable for a breach, a staff member or a legal order to reach. If you can’t find one, you can assume the provider is able to read your files.
7. AI tools and other third parties
AI assistants learn how your business works one chat at a time. You may be willing to reap the many immediate benefits of that learning, but your client may be obligated to hold their data to more rigorous confidentiality standards.
While Open AI and Anthropic say they don’t train their models on business data, researchers have theorized that handing data to a few powerful AI labs teaches them how to make businesses redundant, an idea one Lawfare analysis calls “replacement through knowledge acquisition.”
The same analysis finds those promises thinner than they look: “training” is loosely defined, metadata and summaries may fall outside the promise, the terms can change with each new model, and you can’t check what goes into training. Even “we don’t train on your data” doesn’t mean “we don’t keep it”: most AI services retain prompts for weeks, and personal plans get fewer protections than business ones.
One habit: Pick an AI tool whose data terms you’ve read, and use only that one for client work.
The case for a secure workspace
You now know how infostealers and credential stuffing work, and why zero-access and end-to-end encryption matter. But keeping up with new threats is hard without a dedicated security team.
Proton Workspace handles much of that for you. Choosing it also gives you something to show clients who ask how you protect their data:
- End-to-end and zero-access encryption: Client emails, files and meeting content are encrypted so only you and the people you share with can read them. Not even Proton can.
- Built-in password manager: Unique passwords and breach alerts for every account defend against credential stuffing and infostealers.
- Swiss privacy protection: Your data is stored under some of the world’s strongest privacy laws, outside US and EU surveillance jurisdictions.
Proton Workspace includes encrypted versions of the essentials in Google Workspace and Microsoft 365: email, calendar, cloud storage, documents, spreadsheets and video meetings. It also includes our top-rated VPN and password manager.
