Yes, log who opens the security evidence you share. A record of who accessed which file, and when, lets you spot unexpected viewers, answer a customer who asks whether a document was seen, and prove you control access. The catch is that open links cannot be logged by person.
What you gain from logs
Three practical uses:
- Exposure questions. If a document turns out to be out of date or wrong, you can tell which customers actually opened it and contact them first.
- Anomaly spotting. A report that a customer's single contact opened once is normal. Forty downloads from unfamiliar addresses is not.
- Evidence of control. Buyers and auditors sometimes ask how you restrict and monitor access to confidential material. Logs are a direct answer.
Why open links are the weak point
Tools differ in what they can track. Microsoft's SharePoint documentation says that with an Anyone link, forwarded links work internally or externally and you cannot track who has access to shared items or who has accessed them. By contrast, links limited to specific people require the recipient to be identified, which is what makes a meaningful log possible.
The takeaway is simple: if you want logs by person, do not use an open link. Share with named addresses, and make the recipient sign in or verify through a one-time code.
What to record
Aim for a small set of fields, whatever your tool supports:
- File name and version.
- Who accessed it, by named identity where possible.
- Time and action: view or download.
- Source address or approximate location, if your tool gives it.
- The link or permission that allowed it.
Keep the log for a period that matches your evidence retention policy. If your tool only keeps a short window, export the log on a schedule.
Who should read the logs
Logs nobody reads are theatre. Assign one person, usually in security or the customer facing compliance role, to review them. A weekly look at new external access is plenty for most teams, with alerts for anything unusual, such as access from a country you do not do business in.
Handle the data respectfully. Access logs about customer staff are personal data in many places, so tell customers in your sharing terms that you record access and why. Ask your privacy or legal team for the exact wording.
Linking logs to your register
A log tells you what happened. A register tells you what you intended. Compare them: if someone not on the register opened a file, you have found a gap, either a forwarded link or a permission that was wider than planned. See track what you have shared with each customer.
Try it yourself
Continuous monitoring is the same discipline applied to your software: watch for change, not just state at one moment. This demo shows what that looks like.
Click through it at your own pace, or open it full screen.
Safeguard's compliance and evidence automation helps you produce the files you share. Access logging itself comes from the sharing tool you choose. You can try a free scan to see an export.
Quick check
Can you log access if you email the file as an attachment?
No. Once it leaves your system you cannot see who opens it. Use a link with named access if you need logs.
How long should access logs be kept?
Match your evidence retention policy and any contract terms. If the tool keeps logs only briefly, export them regularly.
Sources
Last reviewed: 19 October 2026.
