Our intern could see what every client was paying us. We had no idea.
We gave our intern Drive access to help with content. Two months later we found out he’d been inside our billing folder the whole time.
The Teakfile teamNotes on sharing Drive safely
Arjun (not his real name) joined us in June. He was a final-year student who wanted to learn digital marketing, and he came in three days a week. Good kid, sharp. We had him scheduling social posts, writing captions and resizing creatives, the usual intern work.
In his first week we added him to the shared Google Drive. It’s what you do, isn’t it? The Drive is where everything lives: briefs, creative assets, reference folders, campaign files. Adding him once was easier than sending individual files over WhatsApp.
He was with us for two months and did decent work. At the end of August he went back to college for his final semester. We wished him well, he said he’d stay in touch, and that was that.
What we found out a month later
In September, one of our senior people was reorganising the Drive, the cleanup we’d put off for six months, and noticed that the billing folder had been opened recently. Not by anyone currently on the team.
We tried to check the access log, but we couldn’t. It was a shared account, and Google can’t tell you which person opened a file when several people use the same login. We did know it wasn’t any of us, though. We’d all been heads down on a campaign that week and nobody had touched billing.
It took about ten minutes to work out that it was probably Arjun. The timing matched, and the folder sat in a part of the Drive that had nothing to do with his work, so he would have had to go looking.
We never told him not to look
Why would we? It didn’t occur to us.
“When you add someone to a shared Drive, you add them to all of it. There’s no “here’s your section, stay out of the rest.””
It’s one login and one view, with everything visible. Arjun wasn’t doing anything wrong in a technical sense. He was curious. He’s twenty-one, he was new, and he was probably trying to understand how the business worked. Plenty of ambitious people poke around like that.
But he saw our rate cards. He saw what Client A paid compared with Client B, and he saw our margins. He saw a discount we had given one client and hadn’t mentioned to anyone else.
A two-month intern shouldn’t have that information, even if he would never do anything with it.
“Once someone knows your pricing, you’ve lost control of something you can’t get back.”
How this could have gone badly
Arjun was fine. He went back to college, started freelancing, and probably doesn’t remember what he saw.
Now imagine a different intern in the same setup: a shared Drive, a billing folder, no restrictions. This intern freelances on the side and is pitching some of your clients, and your rate card has just told him how low he needs to go to undercut you. Or he mentions it to a friend at a competing agency, not out of malice, just in conversation: “You won’t believe what these guys charge.”
You’d never know. You’d just start losing pitches you used to win, without understanding why.
What we needed was embarrassingly simple
We needed to be able to say: this person can access these three folders and nothing else. That’s basic, sensible access control, and any team with more than two people and more than one kind of document needs it.
“We didn’t need Arjun out of the Drive. We needed Arjun in his part of the Drive.”
Creative assets, yes. Client briefs, yes. Campaign reports, yes. The billing folder, the contracts folder and the “internal only” folder, no. Not because we didn’t trust him, but because they had nothing to do with his work.
That boundary should have been easy to set. It wasn’t, because our setup didn’t allow it.
A pattern we’ve noticed since
After this we talked to a few other small agency owners. Every one of them had a version of this story.
- One had given a freelance copywriter Drive access to pick up briefs. The copywriter quietly downloaded the entire client list before the contract ended.
- Another had an ex-employee who forwarded herself a stack of proposal templates on her last day. She wasn’t stealing, she told herself, just keeping copies of work she’d helped create.
None of these are heist stories. They’re the natural result of a setup where everyone can see everything and there’s no way to draw lines.
Three questions to ask about your own Drive
- Who has access to your Google Drive? Not just your current team: every intern, every freelancer, every “temporary” person you added for a project and forgot about.
- Do any of them have access to something they shouldn’t?
- Would you even know?
Key takeaways
- When you add someone to a shared Drive, you add them to all of it, including billing, contracts and client data.
- Curiosity isn’t the risk. The setup is. A boundary shouldn’t depend on someone choosing not to look.
- Give each person only the folders their work needs, and remove access the day the project ends.
Frequently asked questions
- Can you restrict Google Drive access to specific folders?
- With a shared Google account login, no. Everyone with the login sees everything. With individual Google accounts you can share specific folders, but it requires each person to have their own Google account. A team access layer like Teakfile adds per-folder, per-person permissions on top of a single existing Drive account.
- How do you give a freelancer limited access to Google Drive?
- Without Google Workspace or a third-party tool, you cannot meaningfully restrict a freelancer's access if they share your login. The only native option is to share individual files or folders from your account to their personal Google account, but this means creating separate share links for every item and losing centralised control.
- How do small agencies manage Google Drive access for interns?
- Most small agencies add interns to a shared account login, giving them unintentional access to all files including billing, contracts, and client data. The better approach is per-folder access control so interns only see what's relevant to their work.
Share this story
