ShareAndGoShareAndGo

Security

Where your data lives, and why people keep asking.

A few years ago, almost nobody asked a small firm where its files were kept. Today the question turns up in client security questionnaires, insurance applications, engagement letters and conversations with prospects. "Where is our data?" has become a normal thing to ask a service provider.

This article explains why the question matters, what a complete answer covers, the questions to put to any document platform, and how ShareAndGo answers it.

Why the question comes up

There are several reasons clients care where their information is held, and they are not all legal:

  • Contracts. Larger clients sometimes include terms in their agreements about where their data may be kept or processed.
  • Sector rules. Some industries and some government work carry their own expectations about data location. Your attorney can tell you whether any apply to a given client.
  • State privacy laws. Laws such as the California Consumer Privacy Act and similar laws in other states focus on how personal information is collected, used and shared, and often on which service providers handle it.
  • Insurance. Cyber insurers may ask which outside services hold sensitive data, as part of judging risk.
  • Plain trust. Many clients simply want to know, and an evasive answer worries them more than any particular location would.

Whatever the reason, the person asking usually wants a straight answer rather than a reassurance.

A complete answer has more than one part

"Where is the data?" sounds like it has a single answer. For almost any modern service it does not. Documents may be held in one place, backups in another, and the service may rely on other providers for sign-in, email delivery, payments, analytics or AI processing. A complete answer covers each of those, or points to a list that does.

That is why reviewers increasingly ask for a list of sub-processors or service providers rather than a single location. A vendor that can only give a one-word answer has probably not thought about the rest.

Questions to ask any document platform

  1. Where are uploaded documents kept, including backups?
  2. Which other services handle the data, and for what purpose?
  3. Does any AI processing of documents happen, and which provider performs it?
  4. Where is sign-in handled, and by whom?
  5. Is that information published, for example on a privacy page, and how are changes announced?
  6. What happens to documents when an account closes or a file is deleted?

The answers matter less as a test of a particular location than as a test of whether the vendor knows, and tells you, how its service is put together.

How ShareAndGo answers

Your documents are stored in the United States. Some services run elsewhere, and our privacy policy lists them.

We publish that list rather than summarizing it here, so it can be kept current in one place. If a client or a reviewer asks, point them to our privacy page and quote the sentence above as written.

On deletion: emptying the recycle bin removes the stored files and their previews. At the end of a matter, a room can be exported as a ZIP with its folder structure and an index of every document, so you hold your own copy before anything is removed.

Location is one control among many

Where data is kept is a reasonable question, but it is rarely the most important one for confidential documents. Most leaks involving professional firms come from how documents are shared, not where a server sits: an attachment to the wrong address, a link that anyone can open, access that was never removed.

That is where the product's controls matter most. Recipients verify their email with a six-digit code before entry. Groups see only the folders you allow. View-only documents are rendered and watermarked on our side, and the original file is not sent to the viewer's browser. Invitations have end dates. Every upload is scanned for viruses. And the audit log records every view, upload, download, invitation and change.

How to answer your own clients

If a client asks where their documents are, the best answer is short, accurate and sourced. Say which service you use for client documents, quote that service's own statement about location, and offer the link to its list of providers. If the client has a contractual requirement about location, involve your attorney before agreeing to anything, and check the requirement against what the service actually publishes.

Avoid paraphrasing a vendor's location statement into something stronger than it says. If the vendor says documents are kept in one place and some services run elsewhere, repeat both halves.

Keep your answer current

Vendors change their providers over time, and an answer that was accurate last year may not be today. Check the privacy page of each service that holds client documents when you renew, and before you answer a questionnaire. If you keep a standard answer for clients, date it, and update it whenever a provider announces a change. A dated answer that you can show was checked is more reassuring than an undated one that sounds confident.

Common questions

Where are ShareAndGo documents kept?
Your documents are stored in the United States. Some services run elsewhere, and our privacy policy lists them.
Can a client require a specific location?
They can ask for it in a contract. Your attorney should review any such term against what your providers publish.
Does the location affect who can request my data?
That is a legal question for your attorney.

Keep reading

Privacy policy

The full list of services involved.

Answering client security questionnaires

Handling location and other common questions.

Zero trust for document sharing

The access controls that matter most.