Google Sheet shared by link: how company data quietly leaks

Revoking source access cannot recall a downloaded copy

View full-size diagram

A customer list goes to an outside partner as a “viewer” link. The project ends, the link doesn’t, and nobody remembers who still has it.

The answer: a viewer link can still let the whole dataset leave the company, because a copy belongs to whoever made it and old access stays until someone removes it. Apps Script running with broad permissions widens the gap. Share with named accounts instead of open links, and review access on a schedule. If shared sheets are your team’s main system, see work automation on Google Sheets.

Technical Structure of Link Sharing

Drive ACLs operate on three layers: direct file permissions, link tokens, and group inheritance. Enabling ‘anyone with the link’ publishes a token that bypasses account requirements.

Permission Model Comparison

Type	Account Required	Post-Copy Ownership	Audit Detail	Recommendation
Individual	Yes	Original preserved	Full	Preferred
Link	No	New owner	Limited	Prohibited
Group	Yes	Original preserved	Full	Conditional

Copy Creation Failure Modes

When a viewer executes ‘Make a copy’, ownership moves to the new file. Protected ranges and onEdit triggers are lost because the new owner controls the ACL. Drive API files.copy updates the owners[] array.

Offboarding Ex-Employees

1. Suspend account in Admin console
2. Query Drive audit logs for files modified after termination date
3. Remove from all groups
4. Bulk-transfer file ownership via Apps Script

External Partner Controls

Keep link sharing off for external domains. Grant only individual accounts. Deploy Apps Script with execute-as set to ‘me’.

Apps Script Audit Snippet

function auditSharing() {
  const files = DriveApp.getFiles();
  while (files.hasNext()) {
    const f = files.next();
    const perms = Drive.Permissions.list(f.getId()).items;
    // detect anyoneWithLink or external domains
  }
}

Using Drive Audit Logs

Export to BigQuery or poll via Apps Script every 90 days. Alert immediately on any ‘change owner’ event.

Recurring Review Checklist

• Verify link sharing = off on all files (monthly)
• Extract external domain accounts
• Confirm 100% protected ranges coverage
• Measure Apps Script execute-as = ‘me’ ratio
• Transfer ownership from ex-employees within 7 days

When Not to Use This Approach

If policy mandates internal-domain-only files or more than 100 external editors must collaborate simultaneously, evaluate Google Workspace Enterprise DLP first.

See also: spreadsheet-inventory-limits, apps-script-automation-guide

Final review criteria

The useful question is not how many features the automation has. It is whether the workflow can be understood, recovered, and safely rerun after something goes wrong.

• Raw input is separated from the human-facing working view.
• Each run records success, failure, processed count, and error message.
• Replaying the same input does not create duplicate results.
• Permission changes, quota errors, and external API failures are visible later.

For low-risk internal tasks, that may be enough. For customer replies, booking confirmation, inventory updates, payments, or legal records, the threshold is higher: compare Apps Script against a dedicated SaaS or a small server-backed system before relying on it.